Royal Science Technology Park (RSTP)

Enforcement notice issued; warning imposed. EDPA, March 2025. month-precision date

Record ID

sz-edpa-2025-0001

Jurisdiction

Eswatini

Regulator

EDPA

Type

enforcement notice

Date decided

March 2025

Respondent type

public

Sector

technology

Violations

unlawful data disclosure, failure to notify data breach, failure to implement security measures

Provisions cited

Section 14(1)(b) DPA 2022, Section 14(2) DPA 2022, Section 17(1) DPA 2022, Section 41(2) DPA 2022

Outcome

enforcement notice issued; warning imposed

Status

final

Source

Official document ↗

Record verified

11 July 2026

Summary

A complainant's subject-access response from the Royal Science Technology Park, a public enterprise, was emailed with seven additional recipients copied, disclosing the personal information of three data subjects without consent or legal basis; RSTP also failed to notify the EDPA or the complainant of the compromise as section 17(1) requires. The Authority found the disclosure a significant violation, imposed a warning valid for one year under section 41(2), and directed remedial steps including an apology to the complainant.

PUBLIC-BODY · SUBJECT-ACCESS · UNAUTHORISED-DISCLOSURE · BREACH-NOTIFICATION · WARNING

Cite this decision

Track Eswatini enforcement

Get decision alerts by email

Tell us your jurisdictions and we email you when a regulator's decision passes verification. Privacy.