Cybersecurity law & regulation in Mauritius (2026)

Legal framework

Cybersecurity and Cybercrime Act 2021 (Act No. 16 of 2021), supplemented by the Data Protection Act 2017 (Act No. 20 of 2017); administered by ICTA, CERT-MU, and the Data Protection Commissioner

Key points: cybersecurity in Mauritius

1. 01Comprehensive Cybersecurity Law (2021)

   The Cybersecurity and Cybercrime Act 2021 (Act No. 16 of 2021) repealed the 2003 Computer Misuse and Cybercrime Act. It criminalises unauthorised access, interception, data interference, and system interference, with penalties of up to MUR 2 million and 25 years imprisonment for offences targeting Critical Information Infrastructure.

   icta.mu mauritiusassembly.govmu.org

2. 02Critical Information Infrastructure (CII) Protection

   The 2021 Act defines CII as assets whose incapacity or destruction would have a debilitating impact on essential services or national security. Designated CII owners must conduct annual threat/vulnerability risk assessments and commission annual independent IT Security Audits. The National Cybersecurity Committee is tasked with identifying and maintaining the list of CII.

   icta.mu venturelawltd.com

3. 03Breach Notification, Personal Data (72-hour rule)

   Under the Data Protection Act 2017, controllers must notify the Data Protection Commissioner of a personal data breach without undue delay and, where feasible, within 72 hours of becoming aware. Where the breach poses a high risk to individuals, data subjects must also be notified. Non-compliance carries fines up to MUR 200,000 and up to five years imprisonment.

   dataprotection.govmu.org dlapiperdataprotection.com

4. 04CERT-MU, National Incident Response

   The Computer Emergency Response Team of Mauritius (CERT-MU), under the National Computer Board, coordinates national cybersecurity incident response, issues advisories, and operates a threat-mitigation knowledge-sharing hub launched in 2025. In 2023, CERT-MU was designated an ITU Academy global training centre for cybersecurity capacity building.

   cert-mu.govmu.org cert-mu.govmu.org

5. 05National Cybersecurity Strategy 2023-2026

   Mauritius's current national strategy is built on four pillars: resilient infrastructure, safer cyberspace, cybersecurity innovation and education, and international cooperation. It follows the 2014-2019 strategy and explicitly aims to strengthen incident-reporting mechanisms and law-enforcement technical capacity.

   mitci.govmu.org dig.watch

6. 06Sectoral & Financial Sector Overlay

   The Financial Services Commission (FSC) applies the Data Protection Act 2017 to licensed financial entities and has issued sector-specific cybersecurity guidance. ICTA retains regulatory oversight of the ICT sector under the ICT Act and administers the 2021 Cybersecurity Act, creating layered obligations for operators across critical sectors.

   iclg.com fscmauritius.org

Timeline of decisions

1. 1 Jun 2025Guidance · official
   Budget 2025/26 Announces Cyber Security Operation Centre and CERT-MU Funding

   The National Budget 2025/26 committed Rs 16.2 million to establish a national Cyber Security Operation Centre and to equip CERT-MU and the IT Security Unit (ITSU) with updated tools, responding to more than 5,000 cyber incidents reported in 2024 including hacking, phishing, sextortion, and early AI-enhanced attacks.

   CERT-MU, Government of Mauritius

2. 29 May 2023Guidance · official
   Bank of Mauritius Guideline on Cyber and Technology Risk Management Comes into Force

   Published 9 March 2023 and effective 29 May 2023, this guideline sets binding minimum requirements for all BOM-licensed banks and financial institutions covering cyber governance, threat monitoring, incident response, and third-party technology risk, the first sector-specific cyber rulebook issued by the central bank.

   Bank of Mauritius

3. 1 Feb 2023Decision · official
   CERT-MU Designated ITU Academy Global Training Centre for Cybersecurity

   In February 2023 the ITU Academy nominated CERT-MU as a global training centre for cybersecurity capacity building, recognising Mauritius as a regional hub for cyber skills development and cementing its role in supporting other African and island-state governments.

   ITU Academy

4. 1 Jan 2023Guidance · official
   National Cybersecurity Strategy 2023-2026 Adopted

   Mauritius launched its second-generation National Cybersecurity Strategy for 2023-2026, built on four pillars: resilient critical information infrastructure, safer cyberspace, innovation and education, and regional/international partnerships. It operationalises enforcement of the 2021 Act, mandating periodic IT security risk assessments and incident-reporting policies for critical-infrastructure operators.

   Ministry of Information Technology, Communication and Innovation (MITCI)

5. 19 Nov 2021Law · official
   Cybersecurity and Cybercrime Act 2021 Enacted (Proclaimed 10 December 2021)

   Act No. 16 of 2021 replaced the 2003 Computer Misuse and Cybercrime Act, creating a comprehensive framework: it formally constituted CERT-MU as a statutory department, established the National Cybersecurity Committee, defined and protected Critical Information Infrastructure (CII), and raised maximum penalties for CII attacks to Rs 2 million and 25 years imprisonment.

   ICTA / Government of Mauritius (Official Gazette)

6. 1 Aug 2017Guidance · official
   National Cybercrime Strategy 2017-2019 Published

   Mauritius published a stand-alone Cybercrime Strategy (August 2017) to operationalise the criminal-justice dimension of cybersecurity: guiding police and prosecutors in detecting and prosecuting cybercrime, and building judicial capacity to handle digital evidence, complementing the broader 2014 cybersecurity strategy.

   Government of Mauritius (Ministry of Defence and Home Affairs)

7. 1 Jan 2014Guidance · official
   First National Cybersecurity Strategy 2014-2019 Adopted

   Mauritius adopted its inaugural National Cybersecurity Strategy, establishing a governance architecture for protecting information systems and networks across government and critical sectors. This document set the policy foundation later codified in the 2021 Act and the 2023-2026 strategy.

   ITU National Strategies Repository (Government of Mauritius document)

8. 21 Nov 2013Decision · official
   Mauritius Accedes to the Budapest Convention on Cybercrime, First African State

   On 21 November 2013, Mauritius deposited its instrument of accession to the Council of Europe's Budapest Convention on Cybercrime, becoming the first African country to do so. Accession aligned domestic legislation with international standards and enabled mutual legal assistance for cross-border cybercrime investigations.

   Council of Europe — Cybercrime Division

9. 9 Aug 2003Law · official
   Computer Misuse and Cybercrime Act 2003 Enacted

   Mauritius enacted its first dedicated cybercrime statute on 9 August 2003, criminalising unauthorised computer access, interception of data, malicious code distribution, and electronic fraud. Amended in 2016 to add cyber-harassment offences, the Act remained the primary cybercrime law until replaced by the 2021 Act.

   WIPO Lex (Mauritius legislature)

10. 1 Jan 2001Law · official
    Information and Communication Technologies Act 2001 Enacted

    Act No. 44/2001 established the Information and Communication Technologies Authority (ICTA) as the national ICT regulator and created the overarching legal framework for ICT governance in Mauritius, the foundational statute upon which all subsequent cybersecurity legislation was built.

    ICTA, Government of Mauritius

Sources

1. 1.icta.mu/documents/2021/12/cybersecurity_act_2021.pdf
2. 2.mauritiusassembly.govmu.org/mauritiusassembly/wp-content/uploads/2023/03/bill1521.pdf
3. 3.dataprotection.govmu.org/Pages/The%20Law/Data-Protection-Act-2017.aspx
4. 4.dlapiperdataprotection.com/?t=breach-notification&c=MU
5. 5.cert-mu.govmu.org/cert-mu/
6. 6.mitci.govmu.org/Documents/Strategies/National%20Cybersecurity%20Strategy%202023-2026.
7. 7.dig.watch/resource/the-national-cybersecurity-strategy-2023-2026-of-mauritius
8. 8.iclg.com/practice-areas/cybersecurity-laws-and-regulations/mauritius
9. 9.venturelawltd.com/index.php/2021/12/07/cybersecurity-and-cybercrime-act-2021/
10. 10.cert-mu.govmu.org/cert-mu/wp-content/uploads/2025/04/Cybersecurity-Trends-and-Predictio
11. 11.fscmauritius.org/media/105843/the-data-protection-act-2017.pdf