Section 36: Transfer of personal data outside Mauritius
as enacted (not consolidated). juris shows this Act from a copy that is not the official consolidation, so it may not carry every amendment; the amendments juris holds are listed. It does not confirm that this is the law in force today.
36. Transfer of personal data outside Mauritius
(1) A controller or processor may transfer personal data to another
country where –
(a) he or it has provided to the Commissioner proof of
appropriate safeguards with respect to the protection of
the personal data;
(b) the data subject has given explicit consent to the
proposed transfer, after having been informed of the
possible risks of the transfer owing to the absence of
appropriate safeguards;
(c) the transfer is necessary –
(i) for the performance of a contract between the data
subject and the controller or the implementation
of pre-contractual measures taken at the data
subject’s request;
(ii) for the conclusion or performance of a contract
concluded in the interest of the data subject
between the controller and another person;
(iii) for reasons of public interest as provided by law;
(iv) for the establishment, exercise or defence of a
legal claim; or
(v) in order to protect the vital interests of the data
subject or of other persons, where the data
subject is physically or legally incapable of
giving consent; or
500 Acts 2017 Acts 2017 501
(vi) for the purpose of compelling legitimate interests
pursued by the controller or the processor which
are not overridden by the interests, rights and
freedoms of the data subjects involved and
where –
(A) the transfer is not repetitive and concerns
a limited number of data subjects; and
(B) the controller or processor has assessed
all the circumstances surrounding the data
transfer operation and has, based on such
assessment, provided to the Commissioner
proof of appropriate safeguards with
respect to the protection of the personal
data; or
(d) the transfer is made from a register which, according
to law, is intended to provide information to the public
and which is open for consultation by the public or by
any person who can demonstrate a legitimate interest,
to the extent that the conditions laid down by law for
consultation are fulfilled in the particular case.
(2) A transfer pursuant to subsection (1)(d) shall not involve
the entirety of the personal data or entire categories of the personal data
contained in the register and, where the register is intended for consultation
by persons having a legitimate interest, the transfer shall be made only at
the request of those persons or in case they are to be the recipients.
(3) Subsection (1)(a) and (c)(i), (ii) and (vi) shall not apply to
activities carried out by a public authority in the exercise of its functions.
(4) The Commissioner may request a person who transfers data
to another country to demonstrate the effectiveness of the safeguards or the
existence of compelling legitimate interests and may, in order to protect
the rights and fundamental freedoms of data subjects, prohibit, suspend or
subject the transfer to such conditions as he may determine.
502 Acts 2017 Acts 2017 503
PART VII – RIGHTS OF DATA SUBJECTS