Data Protection Act 2017, enforcement, offences and penalties
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
In force since 15 January 2018.
An enforcement supervision rule binding public and private bodies.
As of 5 September 2026.
What it requires
- Expect the Data Protection Office to be able to serve an enforcement notice requiring you to remedy a contravention within a specified period, appealable under section 51.
- Do not disclose personal data in a manner incompatible with the purpose for which it was collected, or without the prior authority of the controller or processor by whom it is kept.
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Unlawful disclosure of personal data under section 42 states no specific penalty of its own, so it falls to the Act's general penalty at section 43(1): a fine not exceeding 200,000 rupees and imprisonment for a term not exceeding 5 years, or both, for an offence under the Act with no specific penalty or any other contravention of the Act.
Penalty structure
General penalty under section 43(1) for an offence under the Act for which no specific penalty is provided, or any other contravention of the Act; imprisonment of up to 5 years may also be imposed instead of or in addition to the fine. Contravening a regulation made under section 55 carries a separate, lower general penalty of a fine not exceeding 100,000 rupees and imprisonment not exceeding 5 years.
- Rule
- Fixed only
- As of
- 5 September 2026
- Currency
- MUR
- Fixed cap
- 200,000
Who enforces it
Enforcement body
Data Protection Office, headed by the Data Protection Commissioner
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Where the Commissioner considers that a controller or processor has contravened, is contravening, or is about to contravene the Act, the Commissioner may serve an enforcement notice requiring specified steps within a specified period, with a right of appeal.
Unlawfully disclosing personal data outside the purpose for which it was collected, or without the controller's or processor's prior authority, is a separate offence, and any offence for which no specific penalty is provided, or any other contravention of the Act, carries a general penalty.
When LexLint raises it
crawls_webtrains_modelsdeploys_chatbotautomated_outreach
Read the law
official Act text, Financial Services Commission of Mauritius (Government Gazette reproduction)