SeychellesData Protection Act, 2023, records of processing activities and logs of processing operations
Data Protection Act, 2023 (Act 24 of 2023), ss. 37-38 (records of processing activities and logging)
In force since .
A comprehensive regime rule binding public and private bodies.
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
As of .
What it requires
- Maintain a record of all your processing activities and keep logs of all processing operations, with the justification, date and time of each consultation and disclosure and the people involved, and make both available to the Commission on request.
These lines are LexLint's reading of the law's text, as of .
What it makes you log
Who may demand the log
Regulator
What the log must hold
Event time, Actor identity, Access record, Decision basis
Logging duty
Section 37 requires a record of processing activities, held by each controller and each processor and available to the Commission on request; its contents (contact details, purposes, categories, recipients, transfers, legal basis, time limits and security measures) are not log-content values. Section 38 requires logs of all processing operations: logs of consultation and of disclosure record the justification, date and time and, as far as possible, the persons involved, and may be used only for the purposes subsection (4) lists (verifying lawfulness, self-monitoring, integrity and security, and criminal proceedings); they are available to the Commission on request. Neither section states a retention period. Neither section states a territorial test, so the hook is empty.
- Kind
- Explicit
- As of
- Provision
- Data Protection Act, 2023, ss. 37 and 38
- Trigger
- personal_data_processing
What this law does
Section 37 requires each data controller to maintain a record of all processing activities for which it is responsible. Each data processor must maintain a record of all processing activities carried out on behalf of a data controller. The controller and the processor must make the record available to the Commission upon request. Section 38 requires a controller, or a processor acting on its behalf, to keep logs for all processing operations.
The logs of consultation must make it possible to establish the justification for, and the date and time of, the consultation and, as far as possible, the identity of the person who consulted the data, and the logs of disclosure must make it possible to establish the justification for, and the date and time of, the disclosure and, as far as possible, the identity of the person who disclosed the data and of the recipients.
The logs may be used only for the purposes section 38(4) lists, the first of which is to verify the lawfulness of processing. The controller or processor must make the logs available to the Commission upon request.
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot or sends automated outreach.