What should a Mauritius business do after a data breach?

This is not legal advice. This guide is general legal information for Mauritius and does not replace a consultation with a lawyer who has the full context of your case.

A Mauritius business facing a personal data breach should contain the incident, preserve evidence and establish what data and people are affected. It must also assess notification under the Data Protection Act 2017 without waiting for a perfect forensic report. Technical recovery and legal compliance should run together. Neither should erase the record needed by the other.

Contain the breach while preserving a reliable incident record

Restrict the compromised account, token or network route. Isolate affected systems where that can be done safely, and protect clean backups. Do not wipe a device or rebuild a server until the forensic team has considered what logs, memory or malicious files must be preserved.

Open an incident record with the first alert, who received it and every containment decision. Record times in one time zone. Preserve security alerts, authentication logs, administrator actions, suspicious emails and the provider’s case number. This chronology will support notification and later review.

Assign operational control. The incident lead should know who may disable services, contact the processor and approve external communications. In practice, delay often sits between IT, management and a supplier because each assumes another person owns the notification question.

Decide what personal data, systems and individuals were affected

A security event is not described adequately by saying that “the server was hacked”. Identify the system, entry point, affected accounts, period of access and whether data was viewed, copied, altered, encrypted or destroyed. Separate confirmed facts from working hypotheses.

Map the information by category. Names and contact details create different risks from identity records, financial details, health information, passwords or a child’s data. Estimate the number of people and records where possible, and state why the estimate may change. The Act’s notification content expressly anticipates categories and approximate numbers.

Consider availability as well as disclosure. A personal data breach can involve loss, alteration or unauthorised access, not only public release. Ransomware that encrypts the only usable copy may therefore raise personal data issues even before exfiltration is proved.

Notification duties under the Data Protection Act 2017

The Act requires a controller to notify the Data Protection Commissioner without undue delay and, where feasible, no later than 72 hours after becoming aware of a personal data breach. If notification falls outside that period, reasons for delay must be supplied. A processor must tell the controller without undue delay after awareness.

The notification should describe the breach, affected categories and approximate numbers where possible. It should give a suitable contact and recommend measures addressing possible adverse effects. The controller must also record the facts, effects and remedial action.

Where a breach is likely to result in a high risk to a data subject’s rights and freedoms, the controller must communicate it to that person without undue delay after notifying the Commissioner. The Act sets circumstances where direct communication is not required, including effective protection that made the data unintelligible. Apply those provisions to evidence, not optimism.

The Data Protection Office now directs controllers and processors to its eDPO portal for the personal data breach form. Access and account arrangements should be checked before an incident. A deadline is a poor time to discover that the responsible officer cannot enter the portal.

Processor contracts, access logs and response decisions to collect

Retrieve the data processing agreement, service description, security schedule, breach clause and current subprocessor list. Check who controls the affected data and who processes it on another’s instructions. Commercial labels such as “customer” and “vendor” do not answer the statutory roles.

Ask the provider for the first detection time, suspected entry, affected tenant, retained logs and preservation measures. Require factual updates at agreed intervals. A processor’s short notice may be enough to start the controller’s clock even if root cause remains open.

For an overseas provider, the contract may raise governing-law, service and recovery questions. These are separate from the controller’s Mauritian notification duty. The guide to contract disputes with a foreign party explains that distinction.

What happens when ransomware or an insider caused the incident?

Ransomware requires containment of the attacker’s access, confirmation of backup integrity and an investigation into possible copying before encryption. Preserve the demand and payment instructions as evidence. Do not assume that restoration proves no data left the system.

An insider incident needs careful access control. Suspend only the permissions necessary to protect systems and evidence, and preserve employment records through the authorised team. Secretly editing the suspected user’s files or conducting uncontrolled interviews can damage the audit trail and create employment issues.

The Cybersecurity and Cybercrime Act 2021 provides the current cybercrime framework. CERT-MU, the Computer Emergency Response Team of Mauritius, publishes an incident route through MAUCORS and its official contact channels. A suspected offence and the personal data notification are distinct processes.

Where a departing person threatens disclosure, urgent court protection may be considered on proper evidence. The guide on injunctions and interim orders in Mauritius explains the purpose of temporary relief.

Communications with customers, staff and overseas partners

Tell affected people what happened in clear language, what information was involved, what the business has done and what they can do. Give a monitored contact point. Avoid saying there is “no risk” while investigation continues, and do not bury practical steps inside promotional language.

Staff need a single approved account and instructions for misdirected enquiries. Overseas partners may need enough information to meet their own duties. Share only what is necessary, particularly where the incident file contains personal data or security details that could aid another attack.

If a foreign judgement later arises from a connected provider or customer dispute, recognition in Mauritius is a separate legal question. The guide to enforcing a French judgement in Mauritius illustrates why a foreign outcome is not simply executed here without analysis.

Remediation and governance after the first response phase

Close the exploited route, rotate affected credentials and test restoration before declaring recovery. Compare actual controls with the written policy and processor contract. The post-incident report should state root cause where known, missed signals, decisions taken and the owner and due date for each corrective action.

Review retention. Data that no longer served its purpose may have enlarged the incident unnecessarily. Confirm access privileges, administrator logging, backup separation, supplier escalation and staff training against the facts that occurred, not an abstract checklist.

A legal dispute may require a barrister and attorney working in their respective roles. The guide to instructing a barrister through an attorney explains how advice, pleadings, procedure and litigation fit together. The chambers’ civil and commercial practice can address the regulatory, contractual and court aspects of a business data breach.

This is not legal advice. This guide is general legal information for Mauritius and does not replace a consultation with a lawyer who has the full context of your case.