Implement the seven foundational Data Protection Principles under Section 21 of the Act (GDPR Article 5 alignment). (1) Lawfulness fairness and transparency - processing must have lawful basis + be fair to data subject + transparent in operation. (2) Purpose limitation - collected for specified explicit legitimate purposes + not further processed incompatibly. (3) Data minimisation - adequate + relevant + limited to what is necessary. (4) Accuracy - accurate + kept up to date + reasonable steps to erase or rectify inaccuracies. (5) Storage limitation - kept in identifiable form only as long as necessary. (6) Integrity and confidentiality - appropriate security including protection against unauthorised or unlawful processing + accidental loss + destruction + damage. (7) Accountability - data controller responsible for and able to demonstrate compliance with Section 21 principles (GDPR-style accountability). Section 22 lawful basis test for compliance. Data Protection Office Mauritius Guidance Notes (2018 + 2020 + 2024) provide operational interpretation. Sectoral codes of conduct may be approved by Commissioner under Section 38.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.