SeychellesData Protection Act, 2023, enforcement and penalties
Data Protection Act, 2023 (Act 24 of 2023), Part VIII (ss. 48-51, offences and penalties)
In force since .
An enforcement supervision rule binding public and private bodies.
- Enforcement body
- Information Commission
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Expect the Information Commission to be able to investigate a complaint, issue an enforcement notice, and impose an administrative fine for a contravention of the Act.
- Do not disclose personal data without lawful justification in a manner incompatible with the purpose for which it was collected.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Criminal exposure note
Obstructing the Commission carries a fine not exceeding SCR200,000 on summary conviction (s. 49(2)); unlawful disclosure of personal data is a separate offence (s. 48); any other contravention with no specific penalty carries imprisonment not exceeding 2 years or a fine at level 5 of the Standard Scale (s. 50(1)).
Penalty structure
The Information Commission's administrative fine for most categories of infringement, including the basic processing principles, data subjects' rights, and cross-border transfers, is capped at SCR200,000 per individual case (s. 51(5)-(6)); the total fine for related infringements of several provisions may not exceed the amount for the gravest infringement (s. 51(4)).
- Rule
- Fixed only
- As of
- Currency
- SCR
- Fixed cap
- 200,000
What it makes you log
Who may demand the log
Regulator
Logging duty
Part VIII makes unlawful disclosure and obstruction of the Commission offences, sets the penalty for an offence with none of its own, and fixes the factors and caps for administrative fines. It imposes no log or record duty. Section 51(6)(e) makes failure to give the Commission access in breach of section 7 a fineable infringement, which is a regulator’s power to demand information that the row itself reaches and not a duty to keep a record. Sections 37 and 38 sit outside the sections cited.
- Kind
- None
- As of
What this law does
A data controller who, without lawful justification, discloses personal data in a manner incompatible with the purpose for which it was collected commits an offence, as does anyone who obstructs the Information Commission (a fine not exceeding SCR200,000 on summary conviction). Any other offence under the Act for which no specific penalty is provided carries imprisonment not exceeding two years or a fine at level 5 of the Standard Scale.
Separately, the Information Commission may impose an administrative fine, capped at SCR200,000 for most categories of infringement, calibrated to be effective, proportionate and dissuasive.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .