Compliance FrameworksMiddle East & Africa
Mauritius Data Protection Act 2017
National data-protection law: technical safeguards, records of processing software, third-party/processor accountability, and integrity controls.
National data-protection law: technical safeguards, records of processing software, third-party/processor accountability, and integrity controls.
| Short name | MU DPA |
| Region | Middle East & Africa |
| Country or scope | Mauritius |
| Sector | Privacy |
| In your workspace | Off until you switch it on in Compliance › Manage. |
How Safeguard covers MU DPA
- Scan requirements: 5, all decided by a scan.
- Controls: the scan requirements below.
- Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
- Policy templates: 22 from the standard set.
How each kind of coverage works, and what the readiness score counts: Compliance frameworks.
What a scan checks
Each scan of a product checks these 5 requirements against what the scan found, including the product's software inventory (SBOM).
| Requirement | What Safeguard checks | Decided by |
|---|---|---|
MU-DPA-31 Security of Processing | Controllers and processors must implement appropriate security and organisational measures, proportionate to the risk, protecting personal data against unauthorised alteration and destruction, evidenced by integrity hashes on processing components (DPA 2017, s. 31) | Scan |
MU-DPA-REC Record of Processing Operations | Controllers must maintain a record of their processing operations, which presupposes an inventory of the software systems that carry out the processing (DPA 2017, record-keeping obligation, s. 33) | Scan |
MU-DPA-BRN 72-Hour Breach Notification Readiness | Personal data breaches must be notified to the Data Protection Commissioner without undue delay (72 hours where feasible), which requires affected components to be quickly identifiable (DPA 2017, s. 25 breach notification) | Scan |
MU-DPA-PROC Processor Guarantees | Controllers may only use processors providing sufficient guarantees, acting under a binding contract, so third-party software components must have named suppliers (DPA 2017, controller-processor provisions) | Scan |
MU-DPA-DOC Demonstrable Compliance Records | The accountability principle requires controllers to demonstrate compliance to the Commissioner, so software records must be identifiable, timestamped documents with a recorded creator (DPA 2017, accountability duties) | Scan |
Policy templates
All 22 from the standard set, adapted to MU DPA.