Data Protection Act, 2011 (Act No. 5 of 2012)
Data Protection Act, 2011 (Act No. 5 of 2012)
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
In force since 22 February 2012.
A comprehensive regime rule binding public and private bodies.
As of 7 September 2026.
What it requires
- Obtain a lawful basis, such as the data subject's consent, before processing personal information of an identifiable individual whose data you collect, whether by automated or non-automated means.
- Do not process personal information revealing a data subject's spiritual, religious or philosophical beliefs, race or ethnic origin, trade union membership, political affiliation, health, sexual life, or criminal behaviour, unless a listed exemption applies.
- Notify the Data Protection Commission and the affected data subject as soon as reasonably possible after discovering that a data subject's personal information has been accessed or acquired by an unauthorised person.
- Do not base a decision that has a legal effect on a person, or significantly affects them, solely on automated processing of their personal information intended to profile their personality or habits, except in narrow contract or statutory circumstances.
- Before transferring personal information out of Lesotho, confirm the recipient is subject to a law, code of conduct or contract that substantially upholds equivalent processing principles, or rely on another listed condition such as consent.
- Give a data subject notice, before or as soon as practicable after collecting personal information about them, of who is responsible for the processing and its purpose, and let them access and correct the personal information held about them.
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Section 55 makes it an offence, on conviction, to hinder, obstruct or unlawfully influence the Commission, breach confidentiality rules made under the Act, obstruct execution of a warrant, or violate any provision of the Act or its regulations without reasonable cause, punishable by a fine not exceeding M50,000 or imprisonment not exceeding five years, or both; where the offender is a juristic person, the sentence is served by the Chief Executive Officer.
Penalty structure
Section 55's closing clause sets a fine not exceeding M50,000 or imprisonment not exceeding five years, or both, for any of the offences the section lists; the text does not distinguish a different cap by offence.
- Rule
- Fixed only
- As of
- 7 September 2026
- Currency
- LSL
- Fixed cap
- 50,000
Who enforces it
Enforcement body
Data Protection Commission
What it reaches
Obligation class
Consent, Data subject rights, Breach notice, Disclosure, Security, Transfer
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
The Data Protection Act, 2011 (Act No. 5 of 2012) establishes the Data Protection Commission and provides for principles regulating the processing of personal information, applying to a data controller domiciled or having its principal place of business in Lesotho, and to a controller outside Lesotho that uses automated or non-automated means in Lesotho or uses such means only for forwarding personal information (s. 3), subject to exemptions for purely personal or household activity, de-identified information, specified State national-security, defence or public-safety functions, and journalistic, artistic or literary expression necessary to reconcile privacy with freedom of expression (s. 4).
A data controller must give a data subject notice of the information being collected and its purpose before or as soon as practicable after collection (s. 25), and may not process spiritual, religious or philosophical beliefs, race or ethnic origin, trade union membership, political affiliation, health, sexual life or criminal behaviour unless a listed exemption applies (s. 29); biometric identifiers are defined in the Act (s. 2) but are not among this enumerated list, so they carry no heightened processing restriction beyond the Act's general lawfulness and security duties.
A data subject may request access to, and free of charge challenge the correctness of, personal information a controller holds about them (ss. 26-27). Where there are reasonable grounds to believe a data subject's personal information has been accessed or acquired by an unauthorised person, the data controller must notify the Commission and, unless the data subject cannot be identified, the data subject as well (s. 23(1)).
Notification to the data subject may be delayed where the Lesotho Mounted Police Service, the National Security Service or the Commission determines that it would impede a criminal investigation (s. 23(3)).
A person may not be subjected to a decision with a legal or significant effect on them based solely on automated processing intended to profile their personality or habits, except where taken in connection with a contract at the data subject's request or under another law with safeguards in place (s. 51).
Transferring personal information outside Lesotho requires the foreign recipient to be subject to a law, code of conduct or contract that effectively upholds substantially similar processing principles, or another listed condition such as the data subject's consent (s. 52). Enforcement combines the Commission's complaint-investigation-and-enforcement-notice process (ss.
39-48) with a data subject's own civil action for damages for breach of any provision of the Act (s. 49), and a criminal offence, on conviction, for hindering the Commission, breaching confidentiality rules, obstructing execution of a warrant, or violating the Act's provisions without reasonable cause, carrying a fine of up to M50,000 or imprisonment of up to five years, or both, with the sentence served by the Chief Executive Officer where the offender is a juristic person (s. 55).
When LexLint raises it
crawls_webtrains_modelsautomated_outreachhigh_risk_decisions