A new Data Protection Act was passed in March 2022. There was no legal instrument governing data flows before then. See Section 33(3) vests the Commission with the discretion to establish the categories of processing for which and the circumstances in which the transfer of personal information to countries outside of Eswatini is not authorized. Note that under Section 32 there is a more open data transfer mechanism within SADC Member States. 