Mauritius Data Protection Office: Businesses Must Obtain Explicit Consent Under New Regulations

• The Data Protection Regulations 2026 came into effect on January 1, 2027, replacing the existing Data Protection Act of 2004.
• The new regulations introduce enhanced provisions for data subject rights and stricter penalties for non-compliance.
• Businesses will need to obtain explicit consent from individuals before collecting or processing their personal data.
• The regulations apply to all organizations operating in Mauritius, including those based outside the country but offering services to Mauritian individuals.

The new regulations provide a robust framework for safeguarding sensitive information and promoting trust between businesses and their customers.

The Mauritius government has introduced a new set of regulations aimed at strengthening data protection in the country. The Data Protection Regulations 2026, which came into effect on January 1, 2027, replace the existing Data Protection Act of 2004. The new regulations are designed to bring Mauritius in line with international best practices and to provide greater protection for individuals' personal data.

The key changes introduced by the new regulations include enhanced provisions for data subject rights, such as the right to access and correct their personal data. Businesses will also be required to obtain explicit consent from individuals before collecting or processing their personal data. Additionally, the regulations introduce stricter penalties for non-compliance, including fines of up to Rs 1 million (approximately USD 25,000).

The introduction of the Data Protection Regulations 2026 marks a significant development in Mauritius' data protection landscape. The regulations are based on the European Union's General Data Protection Regulation (GDPR) and other international standards. The new framework is designed to provide a clear and comprehensive set of rules for businesses operating in Mauritius, ensuring that they handle personal data in accordance with best practices.

The regulations apply to all organizations operating in Mauritius, including those based outside the country but offering services to Mauritian individuals. Businesses will need to review their existing policies and procedures to ensure compliance with the new requirements. The Data Protection Office of Mauritius (DPO) has been tasked with enforcing the regulations and providing guidance to businesses on implementation.

The introduction of the Data Protection Regulations 2026 is a critical step towards protecting individuals' personal data in Mauritius. As more businesses move online, the risk of data breaches and unauthorized use of personal information increases. The new regulations provide a robust framework for safeguarding sensitive information and promoting trust between businesses and their customers.

For lawyers and compliance officers in Mauritius, it is essential to review the new regulations and ensure that their clients' businesses are compliant with the updated requirements. This includes reviewing data handling practices, obtaining explicit consent from individuals, and implementing measures to protect against data breaches.

Lawyers and compliance officers in Mauritius should review the new Data Protection Regulations 2026 to ensure their clients' businesses are compliant with the updated requirements, particularly regarding data subject rights and consent.

Source: Original reporting via Briefly