Data Protection Act 2017, special categories of personal data
Data Protection Act 2017 (Act No. 20 of 2017), s. 29 (special categories of personal data)
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
In force since 15 January 2018.
A sensitive categories rule binding public and private bodies.
As of 5 September 2026.
What it requires
- Do not process a special category of personal data (including biometric data uniquely identifying a person) unless one of the specific grounds in section 29(1) applies, in addition to the Act's general lawful-processing requirement.
- Handle special-category health data only by or under a person bound by professional secrecy where the processing is for preventive or occupational medicine, diagnosis, or healthcare.
If you get it wrong
Criminal exposureYes
Criminal exposure note
A person who contravenes the special-categories processing restriction commits an offence and is liable on conviction to a fine not exceeding 100,000 rupees and to imprisonment for a term not exceeding 5 years (s. 29(3)).
Penalty structure
Fine only under section 29(3); the same subsection also allows imprisonment of up to 5 years instead of or in addition to the fine.
- Rule
- Fixed only
- As of
- 5 September 2026
- Currency
- MUR
- Fixed cap
- 100,000
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Special categories of personal data, defined to include racial or ethnic origin, political opinion, religious or philosophical belief, trade union membership, physical or mental health, sexual orientation, and genetic or biometric data uniquely identifying a person, may be processed only on a specific ground: the general lawful-processing test plus a not-for-profit body's legitimate activity with appropriate safeguards, data manifestly made public by the data subject, or necessity for a legal claim, healthcare, carrying out an obligation or exercising a right of the controller or the data subject, or protecting vital interests.
Health data processed for preventive or occupational medicine or healthcare must be handled by or under a person bound by professional secrecy.
When LexLint raises it
processes_biometricsprocesses_voice
Read the law
official Act text, Financial Services Commission of Mauritius (Government Gazette reproduction)