Data Protection Act, 2011, enforcement and offences

Data Protection Act, 2011, ss. 39-49, 55 (enforcement and offences)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 22 February 2012.

An enforcement supervision rule binding public and private bodies.

As of 19 September 2026.

What it requires

Expect a data subject to be able to complain to the Data Protection Commission alleging a contravention of the Act, and expect the Commission to investigate, conciliate, or take enforcement action.
Comply with an enforcement notice the Commission serves within the period it specifies, whether to take steps or to stop processing personal information, and know that you may apply to the Commission or a court to cancel, vary, or appeal it.
Cooperate with a Commission investigation, including giving evidence on summons and not obstructing execution of a warrant issued to enter and search premises.
Expect a data subject to be able to bring a civil action for damages against you in a court having jurisdiction for breach of any provision of the Act.
Expect criminal liability, on conviction, of a fine of up to M50,000 or imprisonment of up to five years, or both, for hindering the Commission, breaching confidentiality, obstructing a warrant, or violating the Act without reasonable cause, with a juristic person's sentence served by its Chief Executive Officer.

If you get it wrong

Criminal exposureYes

Private right of actionYes

Criminal exposure note

Section 55 makes it an offence, on conviction, to hinder, obstruct or unlawfully influence the Commission, breach confidentiality rules made under the Act, obstruct execution of a warrant, or violate any provision of the Act or its regulations without reasonable cause, punishable by a fine not exceeding M50,000 or imprisonment not exceeding five years, or both; where the offender is a juristic person, the sentence is served by the Chief Executive Officer.

Penalty structure

Section 55's closing clause sets a fine not exceeding M50,000 or imprisonment not exceeding five years, or both, for any of the offences the section lists; the text does not distinguish a different cap by offence.

Rule: Fixed only
As of: 7 September 2026
Currency: LSL
Fixed cap: 50,000

Who enforces it

Enforcement body

Data Protection Commission

What it reaches

Obligation class

Governance, Reporting

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Section 39 lets a person submit a complaint to the Commission alleging a contravention of the Act or, where an approved code of conduct applies, a grievance about a determination under that code, and sections 40 to 45 give the Commission power to investigate, conciliate, decline to act on specified grounds, and inform the parties of the outcome.

Section 43 lets the Commission summon witnesses, administer oaths, receive evidence, and apply to the Magistrate Court for a warrant to enter and search premises where there are reasonable grounds to suspect a contravention or offence.

Section 46 lets the Commission serve a data controller found to have contravened the Act with an enforcement notice requiring it to take specified steps or stop processing personal information within a stated period, and sections 47 to 48 let the controller apply to cancel or vary the notice or appeal it to a court. Section 49 lets a data subject bring a civil action for damages against a data controller in a court having jurisdiction for breach of any provision of the Act.

Section 55 makes it an offence, on conviction, to hinder, obstruct or unlawfully influence the Commission, breach confidentiality rules made under the Act, obstruct execution of a warrant, or violate the Act's provisions without reasonable cause, punishable by a fine not exceeding M50,000 or imprisonment not exceeding five years, or both, with a juristic person's sentence served by its Chief Executive Officer.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot
high_risk_decisions

Read the law

Data Protection Act, 2011 (Act No. 5 of 2012), official text reproduced by LesLII, read through an Internet Archive capture

archived copy

Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2024. Publisher's page: https://lesotholii.org/akn/ls/act/2012/5/eng@2012-02-22

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app