LexLint

Know the law your code answers to.

Law / Eswatini

Data Protection Act, 2022, sensitive personal information

Data Protection Act, 2022, ss. 22-30 (sensitive personal information)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 4 March 2022.

A sensitive categories rule binding public and private bodies.

As of 19 September 2026.

What it requires

  • Do not process sensitive personal information, including genetic data, data related to children, data related to offences or criminal sentences, biometric data, or information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, gender, or health or sex life, unless a listed exemption applies.
  • Obtain prior parental consent before processing personal information under the parental control exemption, and rely on consent, legal necessity, or Commission authorisation for another listed exemption to the prohibition.
  • Where you process a data subject's health or sexual life information under a listed exemption and are not otherwise bound by a confidentiality duty, treat the information as confidential unless required by law or your duties to disclose it.
  • Do not supply personal information about a data subject's race, trade union membership, or political affiliation to a third party without the data subject's consent, even where a listed exemption lets you process it.
  • Apply to the Eswatini Communications Commission for authorisation before processing sensitive personal information in the public interest, and comply with any conditions the Commission imposes on that authorisation.

What it reaches

Obligation class

Prohibition, Consent, Biometric

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Section 22 bars a data controller from processing sensitive personal information unless the Act specifically permits it.

Section 2 defines sensitive personal information to include genetic data, data related to children, data related to offences, criminal sentences or security measures, biometric data, and, where processed for what it reveals, information about racial or ethnic origin, political opinions or affiliations, religious or philosophical beliefs, trade union membership, gender, and health or sex life.

Sections 23 to 28 exempt specific processing of each listed category, including processing by a spiritual or religious organisation of its own members' beliefs, processing necessary to identify a data subject or comply with the law for race, processing by a trade union of its own members for the union's aims, processing by a political institution of its own members for the institution's aims, and processing by a medical professional, healthcare institution, insurer, school, or correctional or pension body for health or sexual life.

Personal information processed under the race, trade union or political exemptions may not be supplied to a third party without the data subject's consent. A data controller permitted to process health or sexual life information who is not otherwise bound by a confidentiality duty must treat it as confidential.

Section 29 lifts the prohibition more generally where processing is carried out with prior parental consent for a child subject to parental control, where it is necessary to establish, exercise or defend a legal right, to comply with an obligation of international public law, where the Commission has authorised it in the public interest under section 30, where the data subject consents, or where the data subject has deliberately made the information public.

Section 30 lets the Commission authorise a data controller to process personal information where the public interest in the processing substantially outweighs the interference with the data subject's privacy, or where the processing carries a clear benefit to the data subject or a third party that substantially outweighs that interference, subject to any conditions the Commission imposes.

When LexLint raises it

  • crawls_web
  • trains_models
  • processes_biometrics
  • serves_minors
  • handles_health_records

Read the law

Data Protection Act, 2022, official Government Gazette Extraordinary text hosted by the Eswatini Communications Commission (ESCCOM)

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example  ·  Lint your app