SeychellesData Protection Act, 2023, rights of data subjects
Data Protection Act, 2023 (Act 24 of 2023), ss. 25-32 (data subjects rights)
In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights
- Audit expectation
- none
What it requires
- Give a data subject access to, and the ability to correct or delete, their personal data on request.NIST Privacy FrameworkCT.PO-P3
- Provide a data subject's personal data in a structured, machine-readable and interoperable format on a portability request.NIST Privacy FrameworkCT.DM-P6
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Section 50(1) makes any other contravention of the Act, for which no specific penalty is provided, an offence punishable on conviction by imprisonment not exceeding 2 years or a fine of level 5 on the Standard Scale, and section 50(2) lets the court order forfeiture of equipment used in the offence and order or prohibit an act to stop a continuing contravention. Failing to comply with an enforcement notice is a separate offence with a fine not exceeding level 5 (section 8(7)).
Penalty structure
Section 51(5) subjects infringements of the obligations of the data controller and the data processor to administrative fines up to SCR200,000, and section 51(6)(b) names the data subjects' rights among the provisions at that ceiling. Section 51(4) caps the total fine for several linked infringements at the amount for the gravest one. The Act states no turnover percentage.
- Rule
- Fixed only
- As of
- Currency
- SCR
- Fixed cap
- 200,000
Who enforces it
Enforcement body
Information Commission
Settledness
- As of
- Open questions
- Within what time must a data controller answer a data subject's request under Part V of the Data Protection Act, 2023, given that section 25(14) leaves the timelines to regulations the Minister may make and sections 26 to 31 state no period for the controller's response?
What it makes you log
Who may demand the log
Data subject
What the log must hold
Access record
Logging duty
Section 27(1)(d) entitles a data subject to a list of the data recipients that accessed the data in the past 6 months, and section 28(4) makes a controller tell the users who accessed the data in the 6 months before a correction request; neither can be met without a record of who accessed the data, but neither names a log or sets a period for keeping one, so no retention value is coded. The Part’s complaint route to the Commission (section 25(11) to (13)) is not an audit of a record. Sections 37 and 38 (register and logs, available to the Commission) sit outside the sections this row cites.
- Kind
- Implicit
- As of
- Provision
- Section 27(1)(d) (a list of the recipients that accessed the data in the past 6 months), with section 28(4) (users that accessed the data in the previous 6 months)
- Trigger
- personal_data_processing
What this law does
A data subject has the right to be informed of the use of their personal data, to access it, to have it rectified or deleted, to object to processing for a specific purpose, and to receive it in a structured, machine-readable and interoperable format for portability to another controller. Any person who suffers material or non-material damage from a contravention of the Act has a right to compensation from the data controller or processor responsible.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .