Acts 2017
500
(5) The controller or processor shall provide the Office with
the data protection impact assessment provided for in section 34 and, on
request, with any other information, so as to allow the Office to make
an assessment of the compliance of the processing and in particular of
the risks for the protection of personal data of the data subject and of the
related safeguards.
PART VI – TRANSFER OF PERSONAL
DATA OUTSIDE MAURITIUS
36.
Transfer of personal data outside Mauritius
(1) A controller or processor may transfer personal data to another
country where –
(a)
he or it has provided to the Commissioner proof of
appropriate safeguards with respect to the protection of
the personal data;
(b) the data subject has given explicit consent to the
proposed transfer, after having been informed of the
possible risks of the transfer owing to the absence of
appropriate safeguards;
(c)
the transfer is necessary –
(i)
for the performance of a contract between the data
subject and the controller or the implementation
of pre-contractual measures taken at the data
subject’s request;
(ii)
for the conclusion or performance of a contract
concluded in the interest of the data subject
between the controller and another person;
(iii) for reasons of public interest as provided by law;
(iv) for the establishment, exercise or defence of a
legal claim; or
(v)
in order to protect the vital interests of the data
subject or of other persons, where the data
subject is physically or legally incapable of
giving consent; or