Mauritius

Section 3(5) of the Data Protection Act 2017 applies the Act to a controller or processor who '(a) is established in Mauritius and processes personal data in the context of that establishment; and (b) is not established in Mauritius but uses equipment in Mauritius for processing personal data, other than for the purpose of transit through Mauritius.' Section 3(7) deems a person established in Mauritius if ordinarily resident there or carrying out processing through an office, branch or agency there. This is the pre-2018 European 'use of equipment' test, not the targeting test used by the European General Data Protection Regulation and copied by India, Brazil and others. Practical effect: a foreign software vendor with a Mauritius data centre, colocated servers or on-island devices is in scope; a pure offshore web service with Mauritian customers and no on-island infrastructure has a genuine argument that it is out. Section 3(6) then requires every in-scope foreign controller or processor to nominate a representative established in Mauritius. Section 14 separately bars anyone from acting as controller or processor at all unless registered with the Commissioner; section 16(3) makes the registration certificate valid for three years. The Act binds the State and its ministries, and does not apply to purely personal or household activity, to need-to-know information exchange between ministries and public sector agencies, or to sharing under the Child Sex Offender Register Act 2020.

SECTOR BY SECTOR, checked 19 August 2026. GENERAL LAW - conditional. Section 36(1) of the Data Protection Act 2017 permits transfer where the controller or processor 'has provided to the Commissioner proof of appropriate safeguards', or on explicit informed consent, or under listed necessity grounds (contract, public interest, legal claims, vital interests, or compelling legitimate interests for a non-repetitive transfer of limited scope, which itself still needs proof of safeguards filed with the Commissioner). Section 36(4) lets the Commissioner demand that you demonstrate the safeguards actually work and 'prohibit, suspend or subject the transfer to such conditions as he may determine'. Section 35(1) goes further and requires prior authorisation from the Office where the appropriate safeguards in section 36 cannot be provided. BANKING - conditional, regulator-gated. The Bank of Mauritius does not require data to stay in Mauritius, but a bank must notify it at least 60 days before deploying material cloud services and must maintain a pre-agreed list of the countries where data will be processed. Material outsourcing of any kind needs the Bank's prior authorisation at least 15 working days before signing. Contracts must give the Bank audit rights and the right to take possession of the cloud services and data if the licence is revoked. Free or consumer cloud storage is banned outright. INSURANCE, SECURITIES, FUNDS AND GLOBAL BUSINESS - conditional, regulator-gated. The Financial Services Commission's Cloud Computing Guidelines require 15 business days' written notice before deploying material cloud services, disclosure of the countries where data is stored, notice of any change of location, and the ability to retrieve any stored record at any time. No location ban. EVERY MAURITIUS COMPANY - mirror, and this is the hard wall. Section 190 of the Companies Act 2001 requires the company's constitution, share register, minutes, directors' certificates, financial statements and accounting records to be kept at the registered office, and section 190(4) permits them to be moved only to 'any other place in Mauritius'. Section 194 allows accounting records to be kept outside Mauritius only if accounts and returns disclosing the financial position at intervals of not more than six months 'are sent to, and kept at, a place in Mauritius' and the Registrar is notified. Because Mauritius is an international financial centre, this bites on a very large share of the entities operating there. GAMBLING - conditional, approval-gated. Under the Gambling Regulatory Authority Act 2007 a gaming machine or limited payout machine operator must connect machines 'to a server located at such place designated by the operator and approved by the Board' and must give the Authority direct access to that server. Interactive gambling is licence-only, and section 91A bans anyone in Mauritius from taking part in interactive gambling run from outside the country. TELECOMS - no localisation or mandatory retention rule found in the Information and Communication Technologies Act 2001, checked 19 August 2026. HEALTH - no health-specific storage or transfer rule found, checked 19 August 2026. A Public Health Bill 2026 covering electronic medical records went to consultation in May 2026 and is a draft only. GOVERNMENT CLOUD, EDUCATION, DEFENCE, MAPPING - no published localisation instrument found, checked 19 August 2026.

The instrument is section 36 of the Data Protection Act 2017 read with section 35. Section 36(1)(a) is the main route: proof of appropriate safeguards provided to the Commissioner. The alternatives are the data subject's explicit consent given after being told about the risks, or necessity for a contract with or in the interest of the data subject, public interest laid down by law, legal claims, vital interests, or compelling legitimate interests where the transfer is non-repetitive, concerns a limited number of people, and is still backed by proof of safeguards filed with the Commissioner. Public authorities cannot use the safeguards route or the contract and legitimate-interest routes at all (section 36(3)). Section 35(1) requires prior authorisation from the Office where the safeguards under section 36 cannot be provided, and section 35(3) lets the Office prohibit the intended processing outright. Section 36(4) is a standing power to demand evidence and to prohibit, suspend or condition a transfer after the fact. What is absent matters as much as what is present. There is no adequacy list, no gazetted standard contractual clauses, no binding corporate rules scheme and no certification route on the regulator's site as at 19 August 2026. That leaves a bespoke filing for each transfer, submitted through the DPO Portal at dpo.govmu.org. There is no published statutory decision deadline, so build lead time into any project plan. Mauritius acceded to the Council of Europe data protection convention and its 2018 modernising protocol, which is why the Act reads like a European one, but that produces no automatic transfer route in or out.

The Data Protection Office is established by section 4 of the Data Protection Act 2017 and must 'act with complete independence and impartiality'. Evidence it is operational, all from its own site: a continuous published decision series reaching Decision No 209 dated 11 November 2025, roughly 26 decisions issued during 2025, and an Annual Report for 2024 recording 179 new complaints, 65 site-visit inspections carried out with police assistance, 105 notified personal data breaches, 3,076 registration certificates issued and 112 authorised cross-border transfers. The same report records only 1 data protection officer or senior officer in post against 12 requested, and 3 assistant officers against 6 requested, and its foreword attributes delayed enforcement to resource constraints. The important structural point is that the Act contains no administrative fining power. Sections 15, 42 and 43 create criminal offences prosecuted before a court, with the residual offence under section 43 carrying up to 200,000 rupees (roughly 4,300 US dollars) and up to five years' imprisonment. The Commissioner's own output is therefore determinations, enforcement notices, inspections and refusals rather than penalties. The published decisions are dominated by closed-circuit television complaints. Rated active rather than aggressive: the regulator decides cases continuously and gates transfers, but no completed prosecution was reported for 2024 and the money at stake is small. Other enforcers are separate and busy: the Bank of Mauritius for banks, the Financial Services Commission for insurance, securities, funds and global business, the Information and Communication Technologies Authority for networks and content, the Gambling Regulatory Authority for gaming, and CERT-MU for cyber incidents.

CEILING. Section 21(e) of the Data Protection Act 2017 requires personal data to be 'kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed'. Section 27 goes further than most laws and imposes a positive duty: where the purpose for keeping personal data has lapsed the controller shall destroy the data as soon as is reasonably practicable and notify any processor holding it, and the processor must then destroy it too. There is no fixed maximum number of years. FLOOR. Section 190(2A) of the Companies Act 2001 requires directors to keep the listed company records 'for a period of at least 7 years from the date of the completion of the transaction, act or operation to which it relates', and to keep doing so even after the company is struck off the register. Section 190(2) fixes seven years or seven completed accounting periods for minutes, directors' certificates, shareholder communications and financial statements. The Bank of Mauritius anti-money-laundering guideline repeatedly sets seven years after completion of the transaction, closure of the account or the date of a report to the Financial Intelligence Unit. CONFLICT RESOLUTION. Section 28 of the Data Protection Act allows processing that is necessary for compliance with a legal obligation, so a statutory retention duty overrides the destruction duty for as long as it runs. The practical trap is the tail: once the seven years expire the section 27 destruction duty revives and the data must actually be deleted, not archived indefinitely.

CLOCK ONE, the only hard one. Section 25(1)(a) of the Data Protection Act 2017: 'In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the Commissioner.' Section 25(1)(b) requires reasons for any delay. The notification must describe the nature of the breach, approximate numbers of people and records, a contact point, and recommended mitigation. Section 25(2) requires a processor to notify its controller without any undue delay, with no stated hour count. Section 26 requires communication to affected individuals where the breach is likely to result in a high risk to their rights and freedoms, and section 26(4) lets the Commissioner order that communication if you have not made it. The Office received 105 breach notifications in 2024, so the channel is live. CLOCK TWO, soft. Section 35 of the Cybersecurity and Cybercrime Act 2021 requires owners of critical information infrastructure to notify the National Cybersecurity Committee of cybersecurity incidents impacting national security, public safety or public interest, with CERT-MU reporting up to the Committee. No hour count appears in the Act. From 1 June 2026, five sectors are formally designated critical information infrastructure - financial services banking and non-banking, the public service, information and communication technology and broadcasting, energy and water supply, and transport - so this route now has named addressees. CLOCK THREE, supervisory. Banks and non-bank financial institutions also owe incident and outsourcing-failure reporting to the Bank of Mauritius and the Financial Services Commission under their respective guidelines. The common failure is treating the 72-hour privacy clock as the only one and missing the sector notification entirely.

1. REGISTRATION REACHES PROCESSORS. Section 14 bars any person from acting as controller OR processor unless registered with the Commissioner. A pure supplier that never decides anything about the data still has to register, file a description of the data, say whether it holds special categories, and name the countries it may transfer to. The certificate lasts three years (section 16(3)) and false information on the form is an offence carrying up to 100,000 rupees, about 2,100 US dollars, and five years' imprisonment. 2. THE PRIVACY OFFICER MUST BE YOUR OWN CERTIFIED EMPLOYEE. Regulation 3(1) of the 2026 regulations requires every controller to designate the officer 'from a staff member of the organisation'. You cannot buy this as an outsourced service. Regulation 5(d) requires evidence of certification issued either by the Data Protection Office itself after its own training, or by a training institution the Office has approved. Regulation 3(4) requires the officer's particulars to be sent to the Office within 14 days of designation and within 14 days of any change; regulation 8(1) requires the contact details to be published on the premises or the website. Breaching either is an offence carrying up to 100,000 rupees and five years' imprisonment. There is no size threshold anywhere in the instrument. 3. EVERYTHING IS CRIMINAL. The Act has no administrative fining power. The residual offence under section 43 is up to 200,000 rupees, about 4,300 US dollars, and up to five years' imprisonment, and the court may also order forfeiture of equipment and prohibit the continuing act. The money is small; the criminal record and the stop order are not. 4. COMPANY RECORDS CANNOT LEAVE. Section 190 of the Companies Act 2001 keeps the constitution, share register, minutes, directors' certificates, financial statements and accounting records at the registered office or another place in Mauritius, with 14 days to tell the Registrar if the place changes. Section 194 lets accounting records sit abroad only if six-monthly accounts and returns are sent to and kept at a place in Mauritius. This applies to every Mauritius company, including the thousands of global business entities, and it is invisible if you only read the privacy law. 5. BANK SECRECY SITS ON TOP OF PRIVACY. Section 64 of the Banking Act 2004 makes publishing customer or institution information without express written consent an offence, with up to 500,000 rupees, about 10,600 US dollars, and three years' imprisonment for an individual and up to one million rupees for a body corporate. A standard processor contract does not discharge it; you need explicit secrecy undertakings. 6. THE NETWORK KILL SWITCH IS REAL. Section 18 of the Information and Communication Technologies Act 2001 empowers the Authority to 'take steps to regulate or curtail the harmful and illegal content on the Internet and other information and communication services'. In November 2024 that power was used to order internet providers to block social media platforms nationally in the run-up to the general election; the order was withdrawn after about 24 hours. Nothing has changed in the law since.

DATED AND BINDING. - 1 January 2027: the Data Protection (Designation, Tasks and Position of Data Protection Officers) Regulations 2026, GN 117 of 2026, made 17 June 2026, come into operation. Certification has to be obtained from the Data Protection Office or an Office-approved institution, so capacity is the constraint, not the drafting. - 1 June 2027: owners of designated critical information infrastructure must comply with the Cybersecurity and Cybercrime (Critical Information Infrastructure Designation) Regulations 2026, GN 113 of 2026, which came into operation on 1 June 2026 with a twelve-month compliance window. Designations are reviewed every three years. ANNOUNCED, NOT LAW. The Ministry of Information Technology said in August 2025 that it would bring an Electronic Identity Management Bill anchored on the central population database, critical information infrastructure regulations, artificial intelligence regulation on a hybrid European risk-based and British principles-based model, and social media responsibility measures, and that a National Cyber-Resilience and Cybersecurity Agency would be set up. The Budget Speech 2026-2027 delivered in June 2026 funds a cyber forensic laboratory, a national cybersecurity survey, information security management systems across government, a national fraud reporting and response mechanism at CERT-MU and a threat intelligence sharing platform at the Bank of Mauritius, and promises a National Artificial Intelligence Guideline for higher education and the civil service. A Public Health Bill 2026 covering electronic medical records went to consultative workshop in May 2026. All of these are proposals; none creates an obligation today. DORMANT SWITCHES, which matter more than the bills. - Section 36(4) of the Data Protection Act lets the Commissioner prohibit, suspend or impose conditions on any transfer already under way, with no consultation and no list to check. - Section 35(3) lets the Office prohibit intended processing outright where it thinks risks are insufficiently mitigated. - Section 18 of the Information and Communication Technologies Act supports network-level blocking orders; used in November 2024. - Section 34 of the Cybersecurity and Cybercrime Act 2021 lets a regulatory body direct critical infrastructure owners on security policies and assessments; with the sectors now designated, this can be used immediately and could in principle reach hosting arrangements. - Section 91A of the Gambling Regulatory Authority Act lets the Authority direct internet providers to block offshore gambling sites and direct banks to stop payments.