Mauritius · Compliance
Mauritius Data Protection Act 2017 compliance in Mauritius
Achieve Mauritius Data Protection Act 2017 compliance with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- Compliance, end to end
- Johannesburg office team
- Effivity software included
- Academy training included
Who asks for Mauritius Data Protection Act 2017 in Mauritius
Clients include
Mauritius Data Protection Act 2017 compliance in Mauritius at a glance
Data Protection Act 2017 (Act 20/2017) is the instrument itself: it applies to the organisations within its scope, and buyers and partners in Mauritius ask for evidence that you meet it.
Registration with the Data Protection Office is where Mauritian privacy work starts. The Data Protection Act 2017, proclaimed with effect from 15 January 2018, says that subject to its exceptions no one may act as a controller or processor unless registered with the Commissioner. It then sets principles, notice at collection, consent conditions, data subject rights, security, records of processing, impact assessments, breach notification within 72 hours where feasible, and rules for transfers abroad. Regulations made in June 2026 will require each controller to designate a data protection officer from 1 January 2027. No certificate proves compliance, so the evidence is the registration, records, contracts, assessments and a tested breach procedure. Sterling's Johannesburg office runs the programme with clear owners for each obligation, using Effivity to keep evidence current and 20+ years of practice to sequence the work.
Who needs Mauritius Data Protection Act 2017 in Mauritius, and what happens without it
These are the organisations in Mauritius that most often need to show Mauritius Data Protection Act 2017.
- Any business that decides how personal data is usedThe Act applies to controllers and processors established in Mauritius and to those outside it that use equipment in Mauritius, who must nominate a representative.
- Organisations that must designate a data protection officerFrom 1 January 2027 every controller must designate an officer from its staff, tell the Office, publish the contact details and support the officer's independence.
- BPOs, cloud and software providers acting as processorsThe Act requires a written contract under which a processor acts only on the controller's instructions and carries the controller's security obligations.
- Operators of high-risk processing such as profiling, large-scale special categories or public-area monitoringThe Act requires an impact assessment before such processing and consultation with the Office where high risk remains.
- Groups that send personal data to other countriesThe Act sets out the safeguards or other bases that allow a transfer, and the Commissioner may suspend or condition a transfer.
Not sure which of these applies to you?Answer a short set of questions and your readiness report arrives by e-mail.
Take the free readiness checkMauritius Data Protection Act 2017 requirements in Mauritius
Strip away the vocabulary and Mauritius's Data Protection Act requires a business to comply in six areas of personal data handling.
In Mauritius these six sit alongside the local laws and regulations listed under drivers below; one system can evidence both. The detail is on the global hub: Mauritius Data Protection Act 2017 explained →
How to achieve Mauritius Data Protection Act 2017 compliance in Mauritius
One team from the Johannesburg office carries the work from scoping to sign-off. Clients across Mauritius are served from Sterling's Johannesburg office, on-site where the work needs it and remotely otherwise.
- Discovery call and scopeEntities, locations, regulators and target date, agreed before any proposal.
- Gap assessment against Mauritius Data Protection Act 2017 and the Mauritian requirements that apply to youControls you already run for your regulators and customers are reused, not rebuilt.
- Your system built with your team in EffivityRisks, controls, evidence, incidents and reviews in one live system the auditor can see.
- Internal audit, management review and corrective actionsYour internal auditors trained by Sterling; the evidence proven before any external review.
- Reviews by regulators, customers and auditorsSterling supports the reviews your regulators, customers and auditors run.
- End to end, from one team
- Effivity ISO & GRC software
- Preferential Sterling Academy access, with complimentary awareness training for your people
- Internal auditor training for your audit team, as applicable to your standard
- Vulnerability assessment on ISMS engagements
The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements.Sterling does not certify. Certification decisions stay with independent bodies.
How long does Mauritius Data Protection Act 2017 compliance take in Mauritius?
There is no standard duration: it depends on your scope and on how much of the system already runs. In Mauritius these are the factors that set the timeline.
- Number of processing activities, systems and processors to map
- Registration status and any change to registered particulars
- Designation and training of the data protection officer before the 2026 regulations apply
- Cross-border transfers and the safeguards behind each one
Sterling agrees a dated plan with you on the discovery call, once the scope is known.
How much does Mauritius Data Protection Act 2017 compliance cost in Mauritius?
The cost has two parts: the consulting work to build and prove the system, and any external assessor’s fees, which are quoted separately. In Mauritius these factors move both.
- Number of legal entities and business units in scope
- Volume and sensitivity of personal data, including special categories
- Processor contract review and impact assessments
- Security control remediation
Sterling gives one customised, all-inclusive proposal after the discovery call, never before the scope is agreed.
Mauritius Data Protection Act 2017 consultants and assessors in Mauritius
Two different organisations are involved. A consultant helps you build the system and prove it works; your regulators, customers and auditors then audits or assesses it and decides. Keeping the two separate is what makes the result credible to buyers and regulators.
- Check that the body’s accreditation or approval covers Mauritius Data Protection Act 2017 and your sector, and that its certificates can be verified online.
- Ask the consultant how the local requirements in Mauritius are mapped into the same system, so nothing runs twice.
- Ask for client references in your sector; Sterling’s client letters are available on request.
- Agree who owns the evidence and the tool after the engagement; with Sterling the system stays yours, in Effivity.
Laws and regulations that drive Mauritius Data Protection Act 2017 in Mauritius (3)
| Instrument | How it treats the standard |
|---|---|
| Data Protection Act 2017 (Act 20/2017) | The instrument itself Registration with the Commissioner, principles, notice at collection, consent conditions, data subject rights, security, records of processing, impact assessment, breach notification, transfers outside Mauritius and a voluntary certification mechanism. |
| Data Protection (Designation, Tasks and Position of Data Protection Officers) Regulations 2026 (GN No. 117 of 2026) | Regulations Designation, tasks and position of data protection officers, with particulars sent to the Office; they come into operation on 1 January 2027. |
| Data Protection Office guidance, forms and e-DPO registration system | Guidance The Office publishes registration and renewal, records of processing, audit and self-assessment, impact assessment, transfer and certification pages for controllers and processors. |
Accreditation, audit language and remote audits in Mauritius
Compliance, not certification: the Data Protection Act 2017 has no certificate that proves compliance. Evidence is registration with the Office, the record of processing, notices, consent records, processor contracts, impact assessments, security measures, a designated officer and a working breach procedure. Section 48 lets the Office lay down voluntary certification mechanisms, seals and marks and says that a certification does not alter the controller's or processor's responsibility. ISO/IEC 27701 certification by an accredited body is an optional way to evidence a privacy management system. Edition and transition details: Mauritius Data Protection Act 2017 hub →
Audit language
English is the usual language of business records, standards and tenders in Mauritius, with French widely used alongside it, and interviews with staff or suppliers can run in French or another local language. Agree the audit language, any interpreter and the language of controlled documents with the certification body at application.
Remote and on-site
Data mapping, privacy workshops and processor reviews can be on-site or remote; the Act prescribes no external assessment, although the Commissioner may carry out compliance audits and investigate complaints.
Mauritius Data Protection Act 2017 in Mauritius: questions clients ask
What must a controller do after a personal data breach in Mauritius?
Notify the Commissioner without undue delay and, where feasible, not later than 72 hours after becoming aware, giving reasons if later. The notice describes the breach, the contact point and the measures proposed. Where the breach is likely to result in high risk to individuals, the controller then tells them in clear language. A processor must tell the controller without delay. Confirm edge cases with your counsel.
When do the data protection officer regulations apply?
They come into operation on 1 January 2027. From then every controller must designate a data protection officer from its staff, send the officer's particulars to the Office and publish contact details on its premises or website, and a lead officer is needed where it designates more than one. Check with the Office how the rules apply to your structure.
Can personal data be sent outside Mauritius?
Yes, on a listed basis. The controller or processor can provide the Commissioner with proof of appropriate safeguards, rely on the data subject's explicit consent after being told of the risks, or use another ground such as contract necessity or legal claims. The Commissioner may ask for proof and may prohibit, suspend or condition a transfer. Take your counsel's view before relying on any ground.
How quickly must a controller answer an access request?
Within one month of receiving the request the controller must tell the data subject in writing whether action has been taken, and that period may be extended by a further month where the complexity and number of requests justify it. A refusal must give reasons and mention the right to complain to the Commissioner. Seek your counsel's advice on identity checks and excessive requests.
More on Mauritius Data Protection Act 2017 for Mauritian organisations
Other standards Mauritian businesses ask Sterling for
Organisations in Mauritius often combine Mauritius Data Protection Act 2017 with one of these, under one management system where the scopes allow.
Start with a free discovery call from the Johannesburg office
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Data Protection Act 2017 (Act 20/2017) — dataprotection.govmu.org (accessed 11 Oct 2026)
- Data Protection (Designation, Tasks and Position of Data Protection Officers) Regulations 2026 (GN No. 117 of 2026) — dataprotection.govmu.org (accessed 11 Oct 2026)
- Data Protection Office guidance, forms and e-DPO registration system — dataprotection.govmu.org (accessed 11 Oct 2026)
Talk to a consultant
Plan your certification with the Johannesburg team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
southafrica@sterling-grc.com+1 201 263 4443 (global headquarters) · the Johannesburg office replies by e-mail within one working day
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice