AI Masterclass for Data Protection Professionals at 0815 Holiday Inn
AI-Enabled Data Protection — Capacity, Registration and Officer Readiness
Preparing Management Companies and Administered Portfolios for the Data Protection Officer Regulations 2026
From 1 January 2027, the designation of a Data Protection Officer in Mauritius stops being a matter of guidance and becomes a matter of binding regulation. Your officer must be your own staff member. That person must hold certification. You must notify the Data Protection Office within 14 days of designation and within 14 days of any change, and you must publish the officer's contact details.
The duty itself is not new. Section 22(2)(e) of the Data Protection Act 2017 has required every controller to designate an officer responsible for data protection compliance since the Act came into force on 15 January 2018. Section 14 has prohibited any person from acting as a controller or processor unless registered. The obligations have not changed. The test has.
What is new is the arithmetic. In September 2026 the Data Protection Office confirmed that a management company must register as a controller, must additionally register as a processor wherever it processes on behalf of administered entities, and must have its own officer — and that this officer is not, by reason of that appointment, the officer of any entity it administers. Each administered entity is assessed on its own processing activities. No automatic exemption follows from the absence of employees, premises or operational presence. Where individual determination is sought, the matter goes to the Office against twelve criteria, and until a determination is made, no general exemption should be presumed.
For a firm administering a portfolio, this is not one compliance question. It is one question per entity, in two capacities, against a fixed date — a volume problem wearing the clothes of a legal problem. No management company has an existing process for applying a single obligation several hundred times with defensible consistency, because until now nothing has required one.
This practical masterclass builds that process. Participants do not learn the Regulations and go home. They arrive with their portfolio and leave with their capacity map, their triage grid, their first submission to the Data Protection Office drafted, and the standing record of processing operations their officer will be asked for. AI does the volume. The participant makes the judgements. The evidence of those judgements is what the firm will be required to show.
Participants will learn how to:
- Establish, provision by provision, what the Data Protection Act has required since 2018 and what the Data Protection Officer Regulations 2026 add from 1 January 2027.
- Separate a binding statutory requirement from an interpretive position taken in regulatory guidance.
- Determine the capacity — controller, processor, or both — in which the firm and each administered entity acts, and justify that determination from the instrument that creates the processing relationship.
- Resolve dual-capacity registration and cost it accurately against the Data Protection (Fees) Regulations 2020.
- Construct a lawful permission position for AI use on client and entity records before the capacity question is closed, stating the lawful basis, the fields withheld and the human checkpoint.
- Identify when a Data Protection Impact Assessment becomes necessary rather than advisable.
- Triage an administered portfolio against the twelve criteria the Data Protection Office may consider, and rank entities by determination risk.
- Draft a complete case-by-case submission addressing every criterion, with its supporting information identified.
- Resolve the conflict of interest that arises where the Compliance Officer or MLRO also holds the data protection role — one function required to retain, the other to minimise.
- Build and maintain the standing record of processing operations required under section 33.
- Set the designation, notification and publication actions against the 14-day statutory clock.
- Sequence a population of several hundred entities against a fixed commencement date.
The Portfolio Readiness Cockpit
A live oversight dashboard demonstrating:
- Capacity classification across the firm's own and administered processing
- Registration status and fee exposure by entity and by capacity
- Triage position against the twelve criteria, with determination risk ranked
- Submission pipeline and outstanding supporting information
- Notification and publication actions against the 14-day clock
- Certificate renewal cycle and expiry monitoring
- Record of processing operations, maintained as a standing document
Participants will see how a fragmented entity book — administration agreements, mandates, engagement letters, statutory records — is converted into a structured oversight system that supports management decision-making while preserving human accountability for every determination.
Live Lab 1: The Capacity Map
- Classification of a management company across its own and administered processing
- Resolution of three contested operations where the agreement and the practice diverge
- Consistency sweep and exception reconciliation
- Registration position settled in each capacity and priced against the Fees Regulations
- Classification held under challenge from the floor
- Three showcases on live tooling
Live Lab 2: The Evidence Room
- Portfolio triage against the twelve criteria
- Selection of entities for submission, with reasons recorded for those not submitted
- One complete case-by-case submission drafted, addressing every criterion
- Standing record of processing operations built
- Notification and publication actions set against the 14-day clock
- Submission defended under challenge
- Three showcases on live tooling
The Inter-Peer Working Hour
One hundred and ninety-four management company and corporate trustee licensees are facing identical questions, and almost none of them are talking to each other. A facilitated exchange, on a no-attribution basis, on the points that have no settled answer: how peers are reading the staff-member rule against thin-staffed entities, who is submitting for individual determination and who is registering and moving on, and how firms are resolving the officer's conflict with the compliance and reporting functions.
Schedule: Date: 25 November 2026 | Time: 0815 – 1635 | Venue: Holiday Inn, Plaine Magnien
Standards: Professional, practical, real-life, up-to-date action-packed seminar. Training centre and courses approved by the Mauritius Qualifications Authority and fees are refundable by HRDC for company-sponsored participants.
Cost of training: Rs. 25,000 (MQA-Approved and HRDC Refundable up to 90%) - Net Investment after HRDC Refund: Rs.2,500.
CLICK HERE TO DOWNLOAD OUR BROCHURE
FOR MORE INFORMATION, PLEASE LEAVE A MESSAGE ON OUR CONTACT US PAGE ON THIS WEBSITE OR PHONE US ON 466 3333
Frequently Asked Questions
What is the AI-Enabled Data Protection Masterclass?
It is a one-day, practical masterclass for management companies and other firms that administer entities on behalf of others, covering capacity classification, controller and processor registration, Data Protection Officer designation and the case-by-case submission route — ahead of the Data Protection Officer Regulations 2026 coming into force on 1 January 2027. Participants work on their own laptops and leave with four completed instruments.
When and where will it take place?
Wednesday 25 November 2026, from 0815 to 1635, at Holiday Inn, Plaine Magnien, Mauritius.
Who should attend?
Managing Directors, Heads of Compliance, designated and prospective Data Protection Officers, Company Secretaries, Heads of Client Administration and MLROs within management companies, corporate trustees, fund administrators, CIS managers, professional firms with fiduciary arms, and pension scheme administrators.
Is the course MQA-approved and HRDC-refundable?
Yes. The course is MQA-approved and qualifies for an HRDC refund of up to 90% for eligible company-sponsored participants, subject to applicable HRDC conditions.
When must a Mauritian company appoint a Data Protection Officer?
The obligation to designate an officer responsible for data protection compliance has existed since the Data Protection Act 2017 came into operation on 15 January 2018, under section 22(2)(e). The Data Protection (Designation, Tasks and Position of Data Protection Officers) Regulations 2026 — GN 117 of 2026, made 17 June 2026 — come into force on 1 January 2027 and prescribe how that officer must be designated, qualified, notified and published.
Can a Data Protection Officer be outsourced in Mauritius?
Not from 1 January 2027. Regulation 3(1) requires every controller to designate the officer from a staff member of the organisation, subject to paragraph (2) and regulations 5 and 6. External advisers may continue to support the organisation, but the officer function itself must sit internally. Firms currently relying on an outsourced officer have a dated compliance change to make.
Does a management company need to register as both controller and processor?
Yes, where both capacities apply. The Data Protection Office confirmed in its September 2026 Advice to Management Companies that every management company must register as a controller, and must additionally register as a processor where it processes personal data on behalf of administered entities without determining the purposes and means. Registration in one capacity does not replace the obligation to register in the other.
Do administered entities such as GBCs and funds have to register separately?
Each administered entity is a separate legal entity and must be assessed on its own processing activities. The Data Protection Office has stated that no automatic exemption follows from having no employees, no premises, limited activities or records maintained by the management company. These are relevant factors but are not determinative on their own.
Is the management company's Data Protection Officer also the officer of the entities it administers?
No. The Data Protection Office has confirmed that the management company's officer is not, by reason of that appointment, the officer of each administered entity, and that the appointment does not automatically satisfy the administered entity's own obligation.
What is the case-by-case route?
Where a management company or administered entity considers that its particular structure and processing arrangements may require individual determination, the matter is submitted to the Data Protection Office for case-by-case assessment against twelve criteria, with complete supporting information. Each case is decided on its own facts, a site visit inspection may be undertaken, and until a determination is made no general exemption should be presumed.
What happens if the designation is not notified or the officer's details are not published?
Under the Regulations, failure to notify the Data Protection Office of the designation within 14 days, or to publish the officer's contact details, is an offence. Separately, acting as an unregistered controller or processor contravenes section 14 of the Data Protection Act 2017.
Does this masterclass certify my Data Protection Officer?
No. Under regulation 5 of the Regulations, evidence of certification is issued by the Data Protection Office following its own training, or by a duly registered and accredited training institution approved by the Office. This masterclass prepares the firm and the person who will hold the role to answer the capacity, registration, population and evidence questions that arrive with the commencement date.
What will participants take away?
Four working instruments, built by the participant during the day: the Capacity Map, the Triage Grid, the Case-by-Case Submission Pack, and the Record of Processing Operations required under section 33 — together with the consolidated statutory and regulatory reference set, each provision cited to its instrument.
Can this programme be delivered in-house?
Yes. The same programme can be delivered in-house, applied to the firm's own portfolio rather than to a constructed case file. The programme is also available in French on request.