Data Protection Act, 2023, enforcement and penalties
Data Protection Act, 2023 (Act 24 of 2023), Part VIII (ss. 48-51, offences and penalties)
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
In force since 22 December 2023.
An enforcement supervision rule binding public and private bodies.
As of 6 September 2026.
What it requires
- Expect the Information Commission to be able to investigate a complaint, issue an enforcement notice, and impose an administrative fine for a contravention of the Act.
- Do not disclose personal data without lawful justification in a manner incompatible with the purpose for which it was collected.
If you get it wrong
Criminal exposureYes
Criminal exposure note
Obstructing the Commission carries a fine not exceeding SCR200,000 on summary conviction (s. 49(2)); unlawful disclosure of personal data is a separate offence (s. 48); any other contravention with no specific penalty carries imprisonment not exceeding 2 years or a fine at level 5 of the Standard Scale (s. 50(1)).
Penalty structure
The Information Commission's administrative fine for most categories of infringement, including the basic processing principles, data subjects' rights, and cross-border transfers, is capped at SCR200,000 per individual case (s. 51(5)-(6)); the total fine for related infringements of several provisions may not exceed the amount for the gravest infringement (s. 51(4)).
- Rule
- Fixed only
- As of
- 6 September 2026
- Currency
- SCR
- Fixed cap
- 200,000
Who enforces it
Enforcement body
Information Commission
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
A data controller who, without lawful justification, discloses personal data in a manner incompatible with the purpose for which it was collected commits an offence, as does anyone who obstructs the Information Commission (a fine not exceeding SCR200,000 on summary conviction). Any other offence under the Act for which no specific penalty is provided carries imprisonment not exceeding two years or a fine at level 5 of the Standard Scale.
Separately, the Information Commission may impose an administrative fine, capped at SCR200,000 for most categories of infringement, calibrated to be effective, proportionate and dissuasive.
When LexLint raises it
crawls_webtrains_modelsdeploys_chatbotautomated_outreach