SeychellesData Protection Act, 2023, automated decisions
Data Protection Act, 2023 (Act 24 of 2023), s. 30(2) (automated individual decisions)
In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights
- Audit expectation
- none
What it requires
- Expect Ministerial regulations to impose measures safeguarding a data subject's rights where a qualifying significant decision about them is based solely on automated processing.
These lines are LexLint's reading of the law's text.
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Section 50(1): a person who commits an offence under the Act for which no specific penalty is provided, or who otherwise contravenes the Act, is liable on conviction to imprisonment not exceeding 2 years or a fine of level 5 on the Standard Scale; the court may also order forfeiture and an order stopping a continuing contravention (section 50(2)).
Penalty structure
Section 51(5) and (6)(b) subject infringements of the obligations of a data controller or processor, and of the data subjects' rights, to administrative fines up to SCR 200,000. The Commission sets each fine case by case under section 51(1) to (3), and where several provisions are infringed in linked processing the total does not exceed the amount for the gravest infringement (section 51(4)).
- Rule
- Fixed only
- As of
- Currency
- SCR
- Fixed cap
- 200,000
Who enforces it
Enforcement body
Information Commission of Seychelles
Settledness
- As of
- Open questions
- Which decisions are "qualifying significant decisions based solely on automated processing" under section 30(2) of the Data Protection Act 2023, a phrase the Act uses without defining, and what measures will the Minister's regulations require for them?
What record it asks for
Logging duty
Section 30(2) only lets the Minister make regulations on safeguards for significant decisions based solely on automated processing, and the Act itself makes none; it names no log, record or audit. The records and logs of sections 37 and 38 sit outside the section this row cites.
- Kind
- None
- As of
What this law does
Section 30(2) empowers the Minister, in consultation with the Commission, to make regulations imposing suitable measures to safeguard a data subject's rights, freedoms and legitimate interests where a qualifying significant decision about them is taken solely on automated processing.
The Act does not itself state what those measures must be: it is a rule-making power rather than a right the data subject or a court can enforce directly, and it takes effect only once the Minister issues implementing regulations.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions.
Back to the example · Lint your app
Page updated .