Mauritius makes the Data Protection Officer role mandatory from January 2027

Cabinet approved these regulations in mid-June and they were gazetted as GN 117 of 2026 — the Data Protection (Designation, Tasks and Position of Data Protection Officers) Regulations 2026. They commence on 1 January 2027, which gives roughly a six-month transitional runway from the point of gazetting.

What changes is the character of the obligation. The Data Protection Act 2017 already contemplated a DPO; in practice many Mauritian organisations treated it as a side duty of whoever ran IT or compliance. The regulations convert that into a specific appointment with a notification requirement, and they prescribe how the role sits inside the organisation: independent, reporting to the highest management level, without conflicting duties.

The provision with operational teeth

The reported requirement that the DPO be drawn from existing staff rather than outsourced is the one to plan around. A number of firms — particularly in the global business sector — had assumed they would retain an external fractional DPO in the way they retain external company secretarial services. If that route is closed, the task becomes recruiting or developing an internal appointee with the right independence, and that takes months rather than weeks.

Treat the six-month runway as the actual deadline, not 1 January.

What to do with the runway

Designate the person and document the reporting line and independence in writing. Budget for Mauritian data-protection law training and any certification. Notify the Data Protection Office within the prescribed window once designated, and publish the DPO's contact details on your website and at your premises.

Then use the remaining time on the substance rather than the paperwork. Build the DPO's mandate into processes that already exist — registration with the Data Protection Office, data protection impact assessments, breach coordination and regulator liaison — instead of standing up a parallel function nobody consults. And complete a data inventory, because the first genuine test of the appointment will be a breach, and the 72-hour notification clock does not pause while somebody works out which systems held the affected records.

A note on sourcing

The regulation name, the GN number and the 1 January 2027 commencement are corroborated across the sources below. The reported 14-day notification deadline and the penalty of up to MUR 100,000 and/or five years' imprisonment rest on a single secondary source at the time of writing. Verify those two figures against the gazetted text before you rely on them for a compliance decision — and if you would like, we will do that check with you.

← All advisories