Cybersecurity law & regulation in Mauritius (2026)

The National Budget 2025/26 committed Rs 16.2 million to establish a national Cyber Security Operation Centre and to equip CERT-MU and the IT Security Unit (ITSU) with updated tools, responding to more than 5,000 cyber incidents reported in 2024 including hacking, phishing, sextortion, and early AI-enhanced attacks.

Published 9 March 2023 and effective 29 May 2023, this guideline sets binding minimum requirements for all BOM-licensed banks and financial institutions covering cyber governance, threat monitoring, incident response, and third-party technology risk, the first sector-specific cyber rulebook issued by the central bank.

In February 2023 the ITU Academy nominated CERT-MU as a global training centre for cybersecurity capacity building, recognising Mauritius as a regional hub for cyber skills development and cementing its role in supporting other African and island-state governments.

Mauritius launched its second-generation National Cybersecurity Strategy for 2023-2026, built on four pillars: resilient critical information infrastructure, safer cyberspace, innovation and education, and regional/international partnerships. It operationalises enforcement of the 2021 Act, mandating periodic IT security risk assessments and incident-reporting policies for critical-infrastructure operators.

Act No. 16 of 2021 replaced the 2003 Computer Misuse and Cybercrime Act, creating a comprehensive framework: it formally constituted CERT-MU as a statutory department, established the National Cybersecurity Committee, defined and protected Critical Information Infrastructure (CII), and raised maximum penalties for CII attacks to Rs 2 million and 25 years imprisonment.

Act No. 20 of 2017, published in the Official Gazette on 23 December 2017 and entering force 15 January 2018, replaced the 2004 Act and aligned Mauritius with GDPR principles, strengthening data-subject rights, cross-border transfer controls, and breach-notification obligations that intersect directly with cybersecurity incident response duties.

Mauritius published a stand-alone Cybercrime Strategy (August 2017) to operationalise the criminal-justice dimension of cybersecurity: guiding police and prosecutors in detecting and prosecuting cybercrime, and building judicial capacity to handle digital evidence, complementing the broader 2014 cybersecurity strategy.

Mauritius adopted its inaugural National Cybersecurity Strategy, establishing a governance architecture for protecting information systems and networks across government and critical sectors. This document set the policy foundation later codified in the 2021 Act and the 2023-2026 strategy.

On 21 November 2013, Mauritius deposited its instrument of accession to the Council of Europe's Budapest Convention on Cybercrime, becoming the first African country to do so. Accession aligned domestic legislation with international standards and enabled mutual legal assistance for cross-border cybercrime investigations.

Mauritius enacted its first dedicated cybercrime statute on 9 August 2003, criminalising unauthorised computer access, interception of data, malicious code distribution, and electronic fraud. Amended in 2016 to add cyber-harassment offences, the Act remained the primary cybercrime law until replaced by the 2021 Act.

Act No. 44/2001 established the Information and Communication Technologies Authority (ICTA) as the national ICT regulator and created the overarching legal framework for ICT governance in Mauritius, the foundational statute upon which all subsequent cybersecurity legislation was built.