Mauritius

Section 3(5) of the Data Protection Act 2017 covers two cases. The first is a company set up in Mauritius that handles personal data through that business. The second is a company that is not set up in Mauritius but uses equipment in Mauritius to handle personal data, other than to pass it through the country. Section 3(7) treats you as set up in Mauritius if you normally live there, or if you work through an office, branch or agency there. This is the old European 'use of equipment' test. It is not the targeting test used by the European General Data Protection Regulation and copied by India, Brazil and others. What that means for you: a foreign software vendor with a Mauritius data centre, rented servers or devices on the island is covered. A pure offshore web service with Mauritian customers and nothing on the island has a real argument that it is not. Section 3(6) then requires every foreign company that is covered to name a representative based in Mauritius. Section 14 separately bans anyone from deciding how personal data is used, or handling it for someone else, unless registered with the Commissioner. Section 16(3) makes the registration certificate valid for three years. The Act binds the State and its ministries. It does not apply to purely personal or household activity. It also does not apply to need-to-know information sharing between ministries and public sector agencies, or to sharing under the Child Sex Offender Register Act 2020.

SECTOR BY SECTOR, checked 19 August 2026. GENERAL LAW - conditional. Section 36(1) of the Data Protection Act 2017 lets you transfer data where you have 'provided to the Commissioner proof of appropriate safeguards'. You can also rely on explicit informed consent, or on listed grounds of necessity. Those grounds are a contract, the public interest, legal claims, vital interests, or compelling legitimate interests for a one-off transfer of limited scope. That last one still needs proof of safeguards filed with the Commissioner. Section 36(4) lets the Commissioner demand that you show the safeguards actually work. It also lets the Commissioner 'prohibit, suspend or subject the transfer to such conditions as he may determine'. Section 35(1) goes further. You need permission from the Office in advance where you cannot provide the safeguards in section 36. BANKING - conditional, regulator-gated. The Bank of Mauritius does not require data to stay in Mauritius. But a bank must tell it at least 60 days before it starts using material cloud services. The bank must also keep an agreed list of the countries where data will be handled. Any material outsourcing needs the Bank's permission at least 15 working days before signing. Contracts must give the Bank audit rights, and the right to take possession of the cloud services and the data if the licence is revoked. Free or consumer cloud storage is banned outright. INSURANCE, SECURITIES, FUNDS AND GLOBAL BUSINESS - conditional, regulator-gated. The Financial Services Commission's Cloud Computing Guidelines require 15 business days' written notice before you start using material cloud services. You must say which countries hold the data, tell the Commission if the location changes, and be able to retrieve any stored record at any time. There is no ban on any location. EVERY MAURITIUS COMPANY - mirror, and this is the strict one. Section 190 of the Companies Act 2001 says the company's constitution, share register, minutes, directors' certificates, financial statements and accounting records must be kept at the registered office. Section 190(4) lets you move them only to 'any other place in Mauritius'. Section 194 lets you keep accounting records outside Mauritius only if accounts and returns showing the financial position at least every six months 'are sent to, and kept at, a place in Mauritius', and the Registrar is told. Mauritius is an international financial centre, so this catches a very large share of the companies there. GAMBLING - conditional, approval-gated. Under the Gambling Regulatory Authority Act 2007, an operator of gaming machines or limited payout machines must connect the machines 'to a server located at such place designated by the operator and approved by the Board'. The operator must give the Authority direct access to that server. Interactive gambling needs a licence. Section 91A bans anyone in Mauritius from taking part in interactive gambling run from outside the country. TELECOMS - we found no rule about where data must be stored, and no duty to keep records, in the Information and Communication Technologies Act 2001, checked 19 August 2026. HEALTH - we found no health-specific rule on storage or transfer, checked 19 August 2026. A Public Health Bill 2026 covering electronic medical records went to consultation in May 2026 and is still a draft. GOVERNMENT CLOUD, EDUCATION, DEFENCE, MAPPING - we found no published rule about where data must be stored, checked 19 August 2026.

The rules are section 36 of the Data Protection Act 2017, read with section 35. Section 36(1)(a) is the main route: you give the Commissioner proof of appropriate safeguards. The alternatives are narrower. The person can give explicit consent after being told about the risks. Or the transfer is needed for a contract with the person, or in their interest. Or it is needed for a public interest set out in law, for legal claims, or for vital interests. Or you rely on compelling legitimate interests, where the transfer is one-off and covers a limited number of people, and you still file proof of safeguards with the Commissioner. Public authorities cannot use the safeguards route, the contract route or the legitimate-interest route at all (section 36(3)). Section 35(1) makes you get permission from the Office in advance where you cannot provide the safeguards in section 36. Section 35(3) lets the Office ban the intended work outright. Section 36(4) is a standing power to demand evidence and to stop, suspend or add conditions to a transfer after the fact. What is missing matters as much as what is there. As at 19 August 2026 the regulator's site shows no list of approved countries, no published standard contract clauses, no group-wide rules scheme and no certification route. So you file a bespoke request for each transfer, through the DPO Portal at dpo.govmu.org. No law sets a deadline for a decision, so build waiting time into any project plan. Mauritius joined the Council of Europe data protection convention and its 2018 update. That is why the Act reads like a European one. It does not create any automatic route for data in or out.

The Data Protection Office is established by section 4 of the Data Protection Act 2017 and must 'act with complete independence and impartiality'. Evidence it is operational, all from its own site: a continuous published decision series reaching Decision No 209 dated 11 November 2025, roughly 26 decisions issued during 2025, and an Annual Report for 2024 recording 179 new complaints, 65 site-visit inspections carried out with police assistance, 105 notified personal data breaches, 3,076 registration certificates issued and 112 authorised cross-border transfers. The same report records only 1 data protection officer or senior officer in post against 12 requested, and 3 assistant officers against 6 requested, and its foreword attributes delayed enforcement to resource constraints. The important structural point is that the Act contains no administrative fining power. Sections 15, 42 and 43 create criminal offences prosecuted before a court, with the residual offence under section 43 carrying up to 200,000 rupees (roughly 4,300 US dollars) and up to five years' imprisonment. The Commissioner's own output is therefore determinations, enforcement notices, inspections and refusals rather than penalties. The published decisions are dominated by closed-circuit television complaints. Rated active rather than aggressive: the regulator decides cases continuously and gates transfers, but no completed prosecution was reported for 2024 and the money at stake is small. Other enforcers are separate and busy: the Bank of Mauritius for banks, the Financial Services Commission for insurance, securities, funds and global business, the Information and Communication Technologies Authority for networks and content, the Gambling Regulatory Authority for gaming, and CERT-MU for cyber incidents.

WHAT YOU MUST DELETE. Section 21(e) of the Data Protection Act 2017 says you may only keep personal data in a form that identifies people for as long as you need it for the purpose. Section 27 goes further than most laws. Once the reason for keeping personal data has gone, you must destroy it as soon as is reasonably practicable. You must also tell anyone holding it for you, and they must destroy it too. There is no fixed maximum number of years. WHAT YOU MUST KEEP. Section 190(2A) of the Companies Act 2001 makes directors keep the listed company records 'for a period of at least 7 years from the date of the completion of the transaction, act or operation to which it relates'. That duty continues even after the company is struck off the register. Section 190(2) sets seven years, or seven completed accounting periods, for minutes, directors' certificates, shareholder communications and financial statements. The Bank of Mauritius anti-money-laundering guideline repeatedly sets seven years. That runs from completion of the transaction, closure of the account, or the date of a report to the Financial Intelligence Unit. WHICH WINS. Section 28 of the Data Protection Act allows you to use data where a law requires it. So a legal duty to keep records overrides the duty to destroy for as long as that duty runs. The trap is the tail end. Once the seven years expire, the section 27 duty to destroy comes back, and the data must actually be deleted, not archived forever.

CLOCK ONE, the only firm one. Section 25(1)(a) of the Data Protection Act 2017 says that after a personal data breach you 'shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the Commissioner'. Section 25(1)(b) makes you give reasons for any delay. The report must describe the breach, roughly how many people and records are affected, a contact point, and what you recommend to limit the damage. Section 25(2) makes a supplier tell the company it works for without undue delay, with no stated hour count. Section 26 makes you tell the affected people where the breach is likely to put their rights and freedoms at high risk. Section 26(4) lets the Commissioner order you to tell them if you have not. The Office received 105 breach reports in 2024, so the channel is live. CLOCK TWO, soft. Section 35 of the Cybersecurity and Cybercrime Act 2021 makes owners of critical information infrastructure tell the National Cybersecurity Committee about incidents that hit national security, public safety or the public interest. CERT-MU reports up to the Committee. The Act sets no hour count. From 1 June 2026, five sectors are formally designated critical information infrastructure. Those are financial services banking and non-banking, the public service, information and communication technology and broadcasting, energy and water supply, and transport. So this route now has named addressees. CLOCK THREE, supervisory. Banks and non-bank financial institutions also owe incident and outsourcing-failure reports to the Bank of Mauritius and the Financial Services Commission under their own guidelines. The common mistake is to treat the 72-hour privacy clock as the only one and miss the industry report entirely.

1. SUPPLIERS MUST REGISTER TOO. Section 14 bans any person from deciding how personal data is used, or handling it for someone else, unless registered with the Commissioner. A pure supplier that never decides anything about the data still has to register. It must file a description of the data, say whether it holds special categories, and name the countries it may send data to. The certificate lasts three years (section 16(3)). False information on the form is an offence carrying up to 100,000 rupees, about 2,100 US dollars, and five years' imprisonment. 2. THE PRIVACY OFFICER MUST BE YOUR OWN CERTIFIED EMPLOYEE. Regulation 3(1) of the 2026 regulations says you must pick the officer 'from a staff member of the organisation'. You cannot buy this as an outsourced service. Regulation 5(d) requires proof of certification. That must come from the Data Protection Office after its own training, or from a training institution the Office has approved. Regulation 3(4) makes you send the officer's details to the Office within 14 days of appointment, and within 14 days of any change. Regulation 8(1) makes you publish the contact details on your premises or your website. Breaking either rule is an offence carrying up to 100,000 rupees and five years' imprisonment. There is no size threshold anywhere in these regulations. 3. EVERYTHING IS CRIMINAL. The Act gives the regulator no power to issue fines itself. The catch-all offence under section 43 carries up to 200,000 rupees, about 4,300 US dollars, and up to five years' imprisonment. The court may also order forfeiture of equipment and stop you from carrying on. The money is small. The criminal record and the stop order are not. 4. COMPANY RECORDS CANNOT LEAVE. Section 190 of the Companies Act 2001 keeps the constitution, share register, minutes, directors' certificates, financial statements and accounting records at the registered office, or another place in Mauritius. You have 14 days to tell the Registrar if the place changes. Section 194 lets accounting records sit abroad only if six-monthly accounts and returns are sent to and kept at a place in Mauritius. This applies to every Mauritius company, including the thousands of global business entities. You will not see it if you only read the privacy law. 5. BANK SECRECY SITS ON TOP OF PRIVACY. Section 64 of the Banking Act 2004 makes it an offence to publish customer or institution information without express written consent. The penalty is up to 500,000 rupees, about 10,600 US dollars, and three years' imprisonment for an individual, and up to one million rupees for a company. A standard supplier contract is not enough. You need explicit secrecy promises. 6. THE NETWORK KILL SWITCH IS REAL. Section 18 of the Information and Communication Technologies Act 2001 lets the Authority 'take steps to regulate or curtail the harmful and illegal content on the Internet and other information and communication services'. In November 2024 that power was used to order internet providers to block social media platforms across the country, ahead of the general election. The order was withdrawn after about 24 hours. Nothing has changed in the law since.

DATED AND BINDING. - 1 January 2027: the Data Protection (Designation, Tasks and Position of Data Protection Officers) Regulations 2026, GN 117 of 2026, made 17 June 2026, come into operation. Certification has to come from the Data Protection Office or an Office-approved institution. The constraint is training capacity, not the drafting. - 1 June 2027: owners of designated critical information infrastructure must comply with the Cybersecurity and Cybercrime (Critical Information Infrastructure Designation) Regulations 2026, GN 113 of 2026. Those came into operation on 1 June 2026 with a twelve-month window to comply. Designations are reviewed every three years. ANNOUNCED, NOT LAW. The Ministry of Information Technology said in August 2025 that it would bring an Electronic Identity Management Bill built on the central population database. It also promised critical information infrastructure regulations, artificial intelligence rules on a mix of the European risk-based and British principles-based models, and social media responsibility measures. It said a National Cyber-Resilience and Cybersecurity Agency would be set up. The Budget Speech 2026-2027, delivered in June 2026, funds a cyber forensic laboratory, a national cybersecurity survey, information security management systems across government, a national fraud reporting and response mechanism at CERT-MU, and a threat intelligence sharing platform at the Bank of Mauritius. It also promises a National Artificial Intelligence Guideline for higher education and the civil service. A Public Health Bill 2026 covering electronic medical records went to a consultation workshop in May 2026. All of these are proposals. None of them creates a duty today. POWERS ALREADY HELD, which matter more than the bills. - Section 36(4) of the Data Protection Act lets the Commissioner stop, suspend or add conditions to any transfer already running, with no consultation and no list to check. - Section 35(3) lets the Office ban intended work outright where it thinks the risks are not sufficiently reduced. - Section 18 of the Information and Communication Technologies Act supports network-level blocking orders. It was used in November 2024. - Section 34 of the Cybersecurity and Cybercrime Act 2021 lets a regulator direct critical infrastructure owners on security policies and assessments. The sectors are now designated, so this can be used immediately and could in principle reach hosting arrangements. - Section 91A of the Gambling Regulatory Authority Act lets the Authority order internet providers to block offshore gambling sites, and order banks to stop payments.