Royal Science Technology Park (RSTP)
Enforcement notice issued; warning imposed. EDPA, March 2025.
The facts
A complainant, anonymised as X in the published notice, asked the Royal Science Technology Park for personal information held about them. When the request went unanswered for two months the complainant escalated it to the board chairperson, and the responding email from human resources was copied to seven unauthorised recipients, including RSTP staff, exposing personal information of three data subjects. The EDPA found the sharing unauthorised, rejected the organisation's assumption that the recipients were family members, and found that RSTP failed to notify the EDPA and the complainant of the data compromise.
Orders and outcome
The EDPA issued an enforcement notice with a warning, directing RSTP to apologise to the complainant within 48 hours, ensure the unauthorised recipients deleted the email within 48 hours, conduct a data protection impact assessment for its human resources department, develop policies protecting transfers of personal information, run regular staff training, develop information security and incident management policies, and report progress within three months. Dated March 2025.
Cite this decision
Track Eswatini enforcement
Tell us your jurisdictions and we email you when a regulator's decision passes verification. Privacy.