Data Protection Act 2017, rights of data subjects

Data Protection Act 2017 (Act No. 20 of 2017), ss. 37-41 (rights of data subjects, including automated individual decision making, s. 38)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

In force since 15 January 2018.

A data subject rights rule binding public and private bodies.

As of 5 September 2026.

What it requires

Do not base a decision producing a legal or similarly significant effect on a data subject solely on automated processing, including profiling, unless a listed exception (contractual necessity, a safeguarded legal authorisation, or the data subject's explicit consent) applies.
Do not base automated processing intended to evaluate personal aspects of an individual on special categories of personal data.
Respond to a data subject's request for access, rectification, erasure or restriction of processing, or an objection to processing.

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Every data subject has a right of access to their personal data, and a right to rectification, erasure or restriction of processing and to object to processing.

Section 38 gives a data subject a right not to be subject to a decision based solely on automated processing, including profiling, that produces a legal effect or significantly affects them, subject to exceptions for contractual necessity, a law with safeguards, or the data subject's explicit consent, and any automated processing intended to evaluate personal aspects of an individual must not be based on special categories of personal data.

When LexLint raises it

high_risk_decisions
crawls_web
trains_models
deploys_chatbot

Read the law

official Act text, Financial Services Commission of Mauritius (Government Gazette reproduction)

Back to the example · Lint your app