Law: The Data Protection Act No.5 of 2022 (the Act)

Regulator: Eswatini Communications Commission (the Commission)

Summary: The Act entered into force on March 4, 2022, on the date of its publication in the Official Gazette, and provides that any processing of personal information should be notified to the Commission and brought into conformity with the Act within two years of the Act's commencement date. However, the Act also outlines that this period may be extended by a maximum of three years by a notice published in the Official Gazette.

Moreover, the Act outlines the requirements for processing personal information, including in relation to retention periods and data security requirements. In addition, the Act provides for several data subject rights, such as the right to access and correct personal information, and includes general provisions on unsolicited electronic communications, as well as automated decision-making.

Further to this, the Constitution of Swaziland Act No. 1 of 2015 establishes a right to privacy, and the Communications Commission (Consumer Protection) Regulations, 2016 issued pursuant to the Swaziland Communications Commissions Act of 2013 and the Consumer Credit Act No. 7 of 2016 addresses aspects of data privacy.