Mauritius Data Protection Office Clarifies Mandatory DPO Designation, Certification and Limited Case-by-Case Assessment

On August 27, 2026, the Mauritius Data Protection Office published an official communiqué clarifying the designation and certification framework under the Data Protection (Designation, Tasks and Position of Data Protection Officers) Regulations 2026.

The general rule requires a controller to designate a staff member as its Data Protection Officer (DPO), and the designated DPO must complete the prescribed certification programme, comprising online training, physical training delivered by Data Protection Office trainers, a written examination and issuance of a certificate by the Office.

A limited case-by-case assessment is available only for specified organisations, including entities with no employees, certain sole traders, very small organisations without suitable staff, and organisations whose personnel mainly perform field-based, manual or general-worker duties without a suitable DPO candidate. Documentary evidence must support the information submitted and may be verified through inspection.

Where an alternative capacity-building arrangement is approved, the person may receive evidence of participation rather than completing the standard certification programme. The underlying Regulations enter into force on January 1, 2027.

Impact

Impact assessment: High. Key reasons: the framework establishes mandatory DPO designation and certification requirements for controllers, with offences for failure to notify designation or publish DPO contact details and a January 1, 2027 commencement date.

Who is affected?

Controllers operating in Mauritius, their designated DPOs, and organisations requiring a case-by-case assessment.

Conclusion:

organisations should identify an appropriate staff member, assess certification needs, and prepare governance and notification processes before the Regulations commence.