Skip to content
World Watch

Data protection & privacy law in Lesotho (2026)

Data protection in Lesotho: comprehensive law.

Lesotho enacted a comprehensive Data Protection Act in 2012 (gazetted 22 February 2012), establishing data-subject rights, controller obligations, and a Data Protection Commission as supervisory authority. However, the Commission and its Commissioner have never been formally appointed, leaving the regime largely unenforced in practice. Courts retain jurisdiction to hear claims and award damages under the Act; no substantive amendment or replacement law had been enacted as of May 2026.

Last verified Official sources first · MethodologyCompare Lesotho with other countries

Legal framework

Data Protection Act, 2012 (Act No. 5 of 2012), Data Protection Commission (established by the Act but not yet appointed)

Key points: data & privacy in Lesotho

  1. Primary legislation

    The Data Protection Act, 2012 (Act No. 5 of 2012), gazetted 22 February 2012, is the single comprehensive instrument governing personal-data protection. It was drafted to align broadly with EU standards and SADC data-protection norms.

    lesotholii.org nic.ls

  2. Supervisory authority, not yet operational

    Part 2 of the Act establishes an independent Data Protection Commission empowered to investigate complaints, issue codes of conduct, and advise on compliance. As of 2026 the Commissioner has never been appointed, rendering the body non-functional; enforcement must therefore proceed through the courts.

    zmayetlaw.co.ls dlapiperdataprotection.com

  3. Data-subject rights

    The Act grants individuals rights to access, correct, and block misuse of their personal data. Data controllers must obtain informed consent before processing and implement reasonable security measures to safeguard personal information.

    lesotholii.org dataprotection.africa

  4. Cross-border transfer restriction

    Personal data may not be transferred to a foreign country unless the recipient is subject to law or binding conduct upholding principles substantially similar to those in the Act, a meaningful adequacy standard.

    lesotholii.org dlapiperdataprotection.com

  5. Penalties and enforcement

    Violations carry fines up to M50,000 and/or imprisonment of up to five years. Because the Commission cannot impose fines directly, enforcement requires court proceedings; the absence of an appointed Commission does not suspend controller obligations.

    zmayetlaw.co.ls afriwise.com

  6. Reform outlook

    Legal commentary as of late 2025 calls for a targeted amendment adding Data Protection Impact Assessments, records of processing, and Data Protection Officers for high-risk entities, as well as ratification of the AU Malabo Convention, but no such amendment had been passed as of May 2026.

    zmayetlaw.co.ls dataprotection.africa

Sources

  1. lesotholii.org/akn/ls/act/2012/5/eng@2012-02-22
  2. lesotholii.org/akn/ls/act/2012/5/eng@2012-02-22/source.pdf
  3. nic.ls/lsnic/community/policies/Data_Protection_Act_2011_Lesotho.pdf
  4. dlapiperdataprotection.com/?t=law&c=LS
  5. dlapiperdataprotection.com/index.html?t=authority&c=LS
  6. dataprotection.africa/lesotho/
  7. zmayetlaw.co.ls/lesothos-outdated-data-protection-act-no-commissioner-no-teeth-what-s
  8. zmayetlaw.co.ls/data-protection-compliance-in-lesotho-why-the-time-to-act-is-now/
  9. afriwise.com/blog/data-protection-compliance-in-lesotho-why-the-time-to-act-is-now

Next for Lesotho: Digital Payments & FintechLicensing regime

Next topic

Orientation, not legal advice: verify against the primary sources linked above. Last verified 24 May 2026. Methodology & how to cite · State of Technology Regulation 2026