Section 31: Transfer of personal data

31. Transfer of personal data (1) Subject to subsection (2), no data controller shall, except with the written authorisation of the Commissioner, transfer personal data to another country. (2) The Eighth Data Protection Principle shall not apply where— (a) the data subject has given his consent to the transfer; (b) the transfer is necessary— (i) for the performance of a contract between the data subject and the data controller, or for the taking of steps at the request of the data subject with a view to his entering into a contract with the data controller; (ii) for the conclusion of a contract between the data controller and a person, other than the data subject, which is entered at the request of the data subject, or is in the interest of the data subject, or for the performance of such a contract; [Issue 5] D3 – 18 Revised Laws of Mauritius (iii) in the public interest, to safeguard public security or national security; (c) the transfer is made on such terms as may be approved by the Commissioner to ensure the adequate safeguards for the protection of the rights of the data subject. (3) For the purpose of subsection (2) (c), the adequacy of the level of protection of a country shall be assessed in the light of all the circumstances surrounding the data transfer, having regard in particular to— (a) the nature of the data; (b) the purpose and duration of the proposed processing; (c) the country of origin and country of final destination; (d) the rules of law, both general and sectoral, in force in the country in question; and (e) any relevant codes of conduct or other rules and security measures which are complied with in that country. [S. 31 amended by s. 10 (f) of Act 14 of 2009 w.e.f. 30 July 2009.] (S. 31 came into operation on 16 February 2009.)