Understanding the Data Protection Act (Mauritius) for Small Businesses
The Mauritius DPA 2017 for SMEs — who must register, what it costs, and how to comply on a small budget.
The Data Protection Act 2017 applies to almost every Mauritian SME. If you store customer names, emails, phone numbers, or ID copies, you're a data controller and you must register with the Data Protection Office (DPO) and follow the Act's principles. Non-compliance can cost up to Rs 200,000 or 2 years' imprisonment.
Do I need to register?
Almost certainly yes if you:
- Hold customer lists (email, phone).
- Take photocopies of NICs.
- Run a loyalty programme, newsletter, or CRM.
- Handle staff HR data.
Registration is done at the DPO website; fees are modest (a few hundred rupees per year).
The 8 data protection principles (in plain English)
- Process data lawfully and fairly.
- Collect only for specified purposes.
- Keep data adequate and not excessive.
- Keep it accurate.
- Don't keep it longer than needed.
- Process it in line with the data subject's rights.
- Keep it secure.
- Only transfer it abroad under safeguards.
Practical steps for a small business
- Write a short privacy policy and link it in your website footer.
- Ask for consent before adding people to newsletters.
- Store customer data in access-controlled tools (not open WhatsApp groups).
- Have a breach response plan — the DPO must be notified within 72 hours.
- Delete data you no longer need.
What a breach looks like
A stolen laptop with client data, a leaked WhatsApp group, or a hacked CRM. Report to the DPO, notify affected customers, and document what happened.
Frequently asked questions
Do I need to register with the Data Protection Office in Mauritius?
Yes if you process any personal data — which almost every business does.
What's the fine for non-compliance?
Up to Rs 200,000 and/or 2 years' imprisonment for serious breaches.
Do I need a Data Protection Officer?
Only larger controllers and processors are strictly required; smaller SMEs can designate a responsible person internally.
Ready to be found by Mauritian buyers, suppliers and other SMEs? List your business free on SME Hub Mauritius →
Keep reading in this cluster
SME Tax in Mauritius: The Complete Compliance Guide for Small Businesses (2026)
Every Mauritian SME tax you'll touch in 2026 — income tax, VAT, PAYE, NPF/NSF — in one plain-English guide.
Tax, VAT & ComplianceBookkeeping Basics for Mauritian SMEs: Stay Audit-Ready All Year
The simple monthly bookkeeping routine that keeps Mauritian SMEs audit-ready.
Tax, VAT & ComplianceCommon Tax Mistakes Mauritian SMEs Make (and How to Avoid Penalties)
The 8 tax mistakes that catch out Mauritian SMEs every year — and the fixes.
Tax, VAT & ComplianceCorporate Tax in Mauritius Explained for Small Business Owners
Everything Mauritian SME directors need to know about corporate tax — 15%, exports at 3%, reliefs and returns.
Frequently asked questions
Do I need to register with the Data Protection Office in Mauritius?
Yes if you process any personal data — which almost every business does.
What's the fine for non-compliance?
Up to Rs 200,000 and/or 2 years' imprisonment for serious breaches.
Do I need a Data Protection Officer?
Only larger controllers and processors are strictly required; smaller SMEs can designate a responsible person internally.
Get found by Mauritian buyers & SMEs
Listing on SME Hub Mauritius is free. Add photos, contact details, and let customers discover you across every district.