Status
Adopted
Consent model
Opt-in
Primary law
Data Protection Act 2011
Year
2011
Authority
Commission provided by law; never fully operational
Marketing consent
Consent-first on paper.
Transfers
The law ties transfers abroad to authorization by the data protection authority.
Penalties
The law provides for fines.
The framework
The Data Protection Act 2011 is on the books in Lesotho without yet being fully enforceable, a gap between enactment and operation that defines the current compliance picture.
That puts Lesotho in the global opt-in majority, where permission comes before processing and marketing waits for consent.
Key instruments
Data Protection Act 2011
2011 · Adopted
Lesotho passed a law in 2011 but the supervisory commission was never properly stood up, leaving the Act largely dormant.
Marketing and advertising
Consent-first on paper. In practice that means consent before tracking or marketing outreach, documented well enough to show a regulator.
Cross-border transfers
The law ties transfers abroad to authorization by the data protection authority.
Enforcement and penalties
The law provides for fines.
Cite this page: "Lesotho Data Privacy Laws." Digital Privacy Regulations, September 28, 2026, https://digitalprivacyregs.com/lesotho.html. Accessed [date].