The long arm of GDPR in Africa: reflection on data privacy law reform and practice in Mauritius

The recently adopted General Data Protection Regulation (GDPR) in the European Union has certainly set the highest standards of all data privacy policies across the world. In theory such standards have provided more control to individuals over their personal data. Due to the strengthened third-party obligations in the GDPR for data export to non-European Union countries and fear of loss of foreign investment if such countries fail to provide adequate protection of personal data, the GDPR exerts profound influence on data privacy law reform and practice outside Europe. This article analyses the impact of the GDPR in Africa by using Mauritius as an intrinsic case study. Mauritius is selected in this analysis due to its leading role in the privacy policy reforms in Africa and the internationalisation of its data protection systems. Accordingly, the development of the data protection system in Mauritius from the repealed Data Protection Act 2004 to the current Data Protection Act 2017 is analysed in detail, drawing on the largest body of reported complaints, appeals and judicial decisions so far decided by courts.