Processes personal data, in the Seychelles

Data Protection Act, 2023 (Act 24 of 2023), Part VIII (ss. 48-51, offences and penalties) · Read the law's page

• Expect the Information Commission to be able to investigate a complaint, issue an enforcement notice, and impose an administrative fine for a contravention of the Act.
• Do not disclose personal data without lawful justification in a manner incompatible with the purpose for which it was collected.

Data Protection Act, 2023 (Act 24 of 2023), s. 47 (cross-border data flows) · Read the law's page

• Confirm the recipient country's processor ensures a comparable level of protection for data subjects' rights before transferring personal data outside Seychelles.
• Check whether the Information Commission has prohibited your transfer as necessary in the public interest.

Data Protection Act, 2023 (Act 24 of 2023), ss. 1-21 (application and data protection principles) · Read the law's page

• Have a lawful basis for processing personal data, such as informed and explicit consent, contractual necessity, a legal requirement, or a legitimate interest.
• Allow a data subject to withdraw consent at any time, without this affecting the lawfulness of earlier processing.

Data Protection Act, 2023 (Act 24 of 2023), ss. 22-24 (processing special categories of personal data) · Read the law's page

• Do not process race, ethnic origin, biometric, genetic, political, religious or health-related personal data unless a specific exception in section 22 applies.
• Obtain consent from a parent or legal guardian before processing the personal data of a person below 18 years, and verify that such consent has been given.

Data Protection Act, 2023 (Act 24 of 2023), ss. 25-32 (data subjects rights) · Read the law's page

• Give a data subject access to, and the ability to correct or delete, their personal data on request.
• Provide a data subject's personal data in a structured, machine-readable and interoperable format on a portability request.

Data Protection Act, 2023 (Act 24 of 2023), ss. 37-38 (records of processing activities and logging) · Read the law's page

• Maintain a record of all your processing activities and keep logs of all processing operations, with the justification, date and time of each consultation and disclosure and the people involved, and make both available to the Commission on request.

Data Protection Act, 2023 (Act 24 of 2023), ss. 43-44 (notification and communication of a personal data breach) · Read the law's page

• Notify the Information Commission of a personal data breach no later than 72 hours after becoming aware of it, giving reasons for any later notification.
• Promptly inform the affected data subjects where a breach is likely to affect a significant number of individuals and their rights and freedoms.