SeychellesData Protection Act, 2023, personal data breach notification
In force since .
A breach notification rule binding public and private bodies.
- Audit expectation
- none
What it requires
- Notify the Information Commission of a personal data breach no later than 72 hours after becoming aware of it, giving reasons for any later notification.
- Promptly inform the affected data subjects where a breach is likely to affect a significant number of individuals and their rights and freedoms.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Section 43(3) requires the controller to record the facts of a personal data breach, its effects and the remedial action taken, in a manner that enables the investigation process to be initiated; none of those fields is in the log-contents list. Section 43(1) and (2) send the Commission a notification of the breach within 72 hours, and a notification alone is not coded as a record or an audit. Section 44 informs the data subject. Neither section gives the Commission a right to read the record, so access and audit are none for this row; the Commission’s section 7(5)(a) inspection power and the logs of section 38 sit outside the sections cited.
- Kind
- Explicit
- As of
- Provision
- Section 43(3) (a record of the personal data breach)
- Trigger
- security_incident
What this law does
A data controller must notify the Information Commission of a personal data breach no later than 72 hours after becoming aware of it, and a late notification must be accompanied by reasons. Where a breach is likely to affect a significant number of individuals and their rights and freedoms, the data controller must promptly inform the affected data subjects.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .