SeychellesData Protection Act, 2023, application and processing principles
Data Protection Act, 2023 (Act 24 of 2023), ss. 1-21 (application and data protection principles)
In force since .
A comprehensive regime rule binding public and private bodies.
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Have a lawful basis for processing personal data, such as informed and explicit consent, contractual necessity, a legal requirement, or a legitimate interest.
- Allow a data subject to withdraw consent at any time, without this affecting the lawfulness of earlier processing.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Who may demand the log
Regulator
What the log must hold
Consent or opt-out state
Logging duty
Section 21(3) requires a data controller to keep appropriate documentation and record keeping for all its processing activities and for its contracts with processors and outsourcing providers, without naming the fields; section 15(9) requires a controller to be able to provide evidence of a data subject’s consent. The Commission may require the receipt or inspection of documentation under section 7(5)(a) when it investigates or audits on a complaint. Section 3 applies the Act to automated processing without a territorial test and to non-automatic processing within Seychelles, which turns on where the processing takes place and so gives no hook value. Sections 37 (a record of processing activities, available to the Commission on request) and 38 (logs of all processing operations, available to the Commission on request) sit in Part VI, outside the sections this row cites, so this row does not borrow their access or audit values.
- Kind
- Explicit
- As of
- Provision
- Section 21(3) (documentation and record keeping of processing activities), with section 15(9) (evidence of consent)
- Trigger
- personal_data_processing
- consent_or_optout
What this law does
The Data Protection Act, 2023 establishes the Information Commission as the enforcing authority and requires every data controller and processor to process personal data lawfully under one of the grounds the Act lists, including consent, contractual necessity, a legal requirement, vital interests, public interest or legitimate interest. Consent must be informed, free and explicit, and a data subject may withdraw it at any time.
The Act applies to automated and semi-automatic processing generally and to non-automatic processing that forms part of a filing system within Seychelles, and it does not exempt processing of personal data that is otherwise publicly available.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .