BY BANELE MAGONGO
MBABANE – In a first of its kind event, the Eswatini Communications Commission (ESCCOM) has awarded certificates to 14 companies for complying with the Data Protection Act of 2022.
The companies were awarded today (April 16, 2024) at the ESCCOM Head Offices in Sibekelo Building in Mbabane. What is interesting is that ESCCOM is among the organisations that were on the receiving end of the awards. In short, it looks like ESCCOM awarded itself the certificate before awarding other organisations.
Other organisations that were awarded include Instacash, Liberty Registrar, Youth Enterprise Revolving Fund (YERF), Eswatini Post Telecommunication Company (EPTC), Eswatini Royal Insurance Company (ESRIC), SNAT SACCO, Ekuphileni Clinic, Foschini Swaziland, SwaziMed, Eswatini Bank, Chakaza Holdings, Ngwenya Glass, and Ezulwini Private Clinic.
Speaking at the event, ESCCOM Chief Executive Officer (CEO) Mvilawemphi Dlamini urged data controllers and processors to follow the example set by the 14 local companies that have been awarded certificates for compliance with the Data Protection Act.
The CEO revealed that the Commission had previously released a decision on the registration of Data Controllers and Data Processors, effective March 1, 2024 with a registration window period set to end on September 30, 2024.
The registration requirement was mandated by the Data Protection Act of 2022, which tasks ESCCOM, in its capacity as the Eswatini Data Protection Authority, to maintain a Register of data controllers and data processors, in order to promote data privacy and ensure compliance with the Act.
He further elucidated that, in line with Section 46 of the Act, the registration process aims to ensure that Data Controllers and Data Processors communicate relevant information to the Eswatini Data Protection Authority (EDPA), including the name and address of the data controller, the purpose of the processing, a description of the categories of data subjects and of the information being processed, the recipients or categories of recipients to whom the personal information may be supplied and planned trans-border flow of personal information.
Dlamini acknowledged the exemplary conduct of the 14 registered entities, lauding their promptness in responding to the EDPA’s call for registration. He stressed that compliance was not merely a compliance obligation, but a value add for businesses as it engenders trust among consumers/data subjects, assuring them of secure data handling by legitimate data controllers and processors duly registered with the EDPA.
He encouraged continued cooperation with the EDPA, requesting their response to any potential consultation processes. He emphasized the importance of timely registration, as the registration window period ends on September 30, 2024.
While acknowledging the growing number of online registrations, he urged entities to pay the requisite registration fees in order to obtain their certificates, as per the Decision. He congratulated the 14 entities on being the pioneers in the Eswatini Register for Data Controllers and Data Processors, under the Data Protection Act.
