Data Protection Act, 2022, transfer of personal information outside Eswatini

Data Protection Act, 2022, ss. 32-33 (transfer outside Eswatini)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 4 March 2022.

A cross border transfer rule binding public and private bodies.

As of 19 September 2026.

What it requires

Before transferring personal information to a recipient in a SADC Member State, confirm the State has transposed the SADC data protection requirements and that the transfer is necessary for a public interest task or your lawful functions, or that no reason exists to think it would prejudice the data subject's legitimate interests.
Before transferring personal information to a recipient outside a SADC Member State, confirm an adequate level of protection is ensured in the recipient's country, considering the nature of the data, the purpose and duration of the processing, and the recipient country's laws and security measures.
Where the recipient country does not ensure adequate protection, transfer personal information there only with the data subject's unambiguous consent, under a listed contractual necessity, on important public interest or legal claims grounds, or from a public register open to consultation.
Where none of the listed derogations applies, obtain the Commission's authorisation for the transfer and satisfy the Commission that adequate safeguards for privacy and fundamental rights, including contractual clauses, will be in place.
Make a provisional evaluation of the necessity of a transfer to a SADC Member State before making it, and be ready to have that necessity verified later.

What it reaches

Obligation class

Transfer

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Section 32 lets personal information be transferred to a recipient in a SADC Member State that has transposed the SADC data protection requirements only where the recipient establishes that the transfer is necessary for a task carried out in the public interest or the controller's lawful functions, or establishes the necessity of the transfer with no reason to assume the data subject's legitimate interests would be prejudiced, and requires the controller to make a provisional necessity evaluation and the recipient to be able to verify that necessity later.

Section 33(1) bars transferring personal information to a recipient outside a SADC Member State, or not subject to SADC derived national law, unless an adequate level of protection is ensured in the recipient's country and the data is transferred solely to permit processing the controller was otherwise authorised to undertake, with adequacy assessed against the nature of the data, the purpose and duration of the processing, and the recipient country's laws and security measures.

Section 33(4) lets a transfer to a country outside Eswatini or SADC that lacks adequate protection proceed anyway where the data subject has unambiguously consented, where the transfer is necessary for a contract with or in the interest of the data subject, where it is necessary or legally required on important public interest grounds or for legal claims, or where it is made from a public register open to consultation.

Section 33(5) lets the Commission authorise such a transfer even without the data subject's consent where the controller satisfies the Commission that adequate safeguards for privacy and fundamental rights will be ensured, including through contractual clauses.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot

Read the law

Data Protection Act, 2022, official Government Gazette Extraordinary text hosted by the Eswatini Communications Commission (ESCCOM)

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app