The Personal Data Protection Act (Act No. 12 of 2012) (“PDPA”) regulates the collection, use
and disclosure of an individual’s personal data. The general rule laid out by the legislation is
that personal data can only be collected, used and / or disclosed with the consent of the
The PDPA has been implemented in two stages. The Do Not Call (“DNC”) registry came into
force on 2 January 2014. The remainder of the provisions, including those pertaining to the
collection, use and disclosure of personal data, came into force on 2 July 2014.