What Is Data Protection Act, 2011 (Act No. 5 of 2012)?
The Data Protection Act, 2011 (Act No. 5 of 2012) is current in the accessible text and commenced on publication. The located provisions support access, qualified correction or deletion, objection, and direct-marketing opt-out rights, including a fourteen-day timeline for the correction outcome described in the Act. The Act creates a Data Protection Commission and a complaint process. April 2026 Ministry commentary reported that the Commission had not yet been established, and the supplied research did not locate an operational general complaint endpoint. A separate credit-reporting route was located and should be kept distinct from a general privacy complaint route. This is a bounded evidence profile based on the accessible statutory text and current government-linked reporting. It does not treat the statutory Commission as an operational regulator while its establishment remains unresolved, and it does not infer a general broker-removal process from the separate credit-reporting route.
At a glance
- Full name
- Data Protection Act, 2011 (Act No. 5 of 2012)
- Short code
- Lesotho Data Protection Act 2011
- Jurisdiction
- Lesotho
- Enacted
- 2011
- Last major update
- Published as Act No. 5 of 2012 and commenced on publication; current government-linked reporting says the statutory Data Protection Commission has not yet been established
- Regulator
- Data Protection Commission (created by the Act; current establishment reported as outstanding)
- Private right of action
- Limited
- Statutory citation
- Data Protection Act, 2011 (Act No. 5 of 2012)
Scope, who Lesotho Data Protection Act 2011 covers
Protected data
Data subject rights
Right of access
Qualified right to correction or deletion
Right to object to processing
Right to opt out of direct marketing
Right to receive the stated correction outcome within fourteen days
Right to use the statutory complaint process, with no operational general endpoint located
Notable features
The Act is identified as the Data Protection Act, 2011 and numbered Act No. 5 of 2012; the accessible text states commencement on publication. It creates a Data Protection Commission, but current government-linked reporting says the Commission has not yet been established.
Enforcement & penalties
Regulator: Data Protection Commission (created by the Act; current establishment reported as outstanding)
Penalties: The supplied research summary did not provide a consolidated penalty schedule or amount, so no penalty figure is stated here.
Private right of action: The Act provides a complaint process and a separate credit-reporting route was documented, but the supplied research does not establish a separate private damages action or an operational general privacy complaint endpoint.
Relevance to data brokers
The supplied summary does not identify a Lesotho-specific data-broker, people-search, or public-record removal route. The separate credit-reporting route should not be presented as a general broker opt-out process.
Generate requests in under 60 seconds
Explore 1,034 US/global data brokers
FAQ
What rights were located in Lesotho's Data Protection Act?+
The supplied research supports access, qualified correction or deletion, objection, and direct-marketing opt-out rights, including a fourteen-day correction-outcome timeline.
Is Lesotho's Data Protection Commission operational?+
The Act creates a Data Protection Commission, but current government-linked reporting says it has not yet been established; an operational general complaint endpoint was not located.
Is the credit-reporting route a general data-broker opt-out?+
No. The separate credit-reporting route should be kept distinct from a general privacy or data-broker removal route.
Official sources & citations
- LesothoLII: Data Protection Act, 2011 (Act No. 5 of 2012)
- Lesotho NIC: Data Protection Act 2011 PDF
- Lesotho News Agency: urgent gaps in cyber security and data protection
- Government of Lesotho: data governance as a national asset
- LesothoLII: related Act No. 1 of 2012
- Central Bank of Lesotho: Financial Consumer Protection Division
Other international privacy regimes
Lesotho Data Protection Act 2011 sits in a global ecosystem of data-protection laws. Start with these comparative frameworks, or visit the privacy research hub for the complete jurisdiction index: