The New DPO Regulations: Five Things Mauritian Organisations Need To Know

The publication of the Data Protection (Designation, Tasks and Position of Data Protection Officers) Regulations 2026 (the “Regulations”) marks an important development in Mauritius’ data protection framework.

The Regulations give a concrete form to what was previously a broadly stated obligation under the Data Protection Act 2017 (the “DPA”). Under section 22(2)(e) of the DPA, controllers have long been required to designate "an officer responsible for data protection compliance issues" as part of their broader obligation to implement appropriate technical and organisational measures. However, the DPA itself was silent on the qualifications, tasks, and protections to be afforded to such an officer. The Regulations now fill this gap comprehensively by providing a detailed regulatory framework that prescribes who may serve as a data protection officer (“DPO”), what they must do, and how their independence must be safeguarded.