Every person who intends to act as a data controller or a data processor (as defined below) must register with the Commissioner in a form approved by the Commissioner and is required to pay a prescribed registration fee. The Commissioner is authorized to approve applications and issue registration certificates, which are valid for three years.

Data processors and controllers must renew their registration within three months prior to the date that their registration expires. Failure to register or renew registration constitutes an offence under the Act, punishable by a fine not exceeding 200,000 Mauritian rupees or imprisonment for a term not to exceed five years.

A data controller is a person or public body who alone, or jointly with others, determines the purposes and means of personal data processing, and who has decision making power with respect to processing. A data processor is a person or public body who processes personal data on behalf of a controller.

Application for registration

Every registration application must include all of the following:

• Name and address;
• Whether a representative has been nominated for the purposes of the Act, and the name and address of the representative;
• A description of the personal data to be processed by the controller or processor, and of the category of data subjects, to which the personal data relate;
• A statement as to whether data controller or processor holds, or is likely to hold, special categories of personal data;
• A description of the purpose for which the personal data are to be processed;
• A description of any recipient to whom the controller intends or may wish to disclose the personal data;
• The name, or a description of, any country to which the proposed controller intends or may wish, directly or indirectly, to transfer, the data;
• A general description of the risks, safeguards, security measures and mechanisms to ensure the protection of the personal data.

A controller or processor who knowingly supplies false or misleading material information in their registration application commits an offense and could be held liable to a fine not to exceed 100,000 Mauritian rupees or imprisonment for a term not to exceed five years.