SeychellesData Protection Act, 2023, cross-border data flows
Data Protection Act, 2023 (Act 24 of 2023), s. 47 (cross-border data flows)
In force since .
A cross border transfer rule binding public and private bodies.
- Audit expectation
- none
What it requires
- Confirm the recipient country's processor ensures a comparable level of protection for data subjects' rights before transferring personal data outside Seychelles.NIST Privacy FrameworkID.DE-P2
- Check whether the Information Commission has prohibited your transfer as necessary in the public interest.NIST Privacy FrameworkCT.PO-P2
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- ID.DE-P2Data processing ecosystem parties (e.g., service providers, customers, partners, product manufacturers, application developers) are identified, prioritized, and assessed using a privacy risk assessment process.
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Section 47 bars a transfer of personal data out of Seychelles unless the recipient ensures a comparable level of protection and lets the Commission set the factors, authorise transfers and prohibit them. It names no log, record or audit. Its special-categories prong turns on the data of Seychellois citizens, which is nationality and gives no hook value.
- Kind
- None
- As of
What this law does
Personal data may not be transferred outside Seychelles unless the recipient country's processor ensures a comparable level of protection for data subjects' rights and freedoms, assessed on a risk-based approach proportional to the threat, the harm's severity, the confidentiality of the information, and the number of affected data subjects. The Information Commission may prohibit a transfer where necessary in the public interest.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .