Seychelles' comprehensive personal-data regime is the Data Protection Act, 2023 (Act 24 of 2023), which repealed the never-brought-into-force Data Protection Act (Cap 57) and applies to automated, semi-automatic and filing-system processing of personal data within Seychelles.
It binds every data controller and processor to a set of processing principles, treats race, biometric, genetic, health and several other categories as sensitive personal data subject to a general prohibition with limited exceptions, gives data subjects access, rectification, deletion, objection, portability and compensation rights, requires breach notification within 72 hours to the Information Commission, and restricts cross-border transfer to countries offering a comparable level of protection.
The Information Commission, established under the Access to Information Act, enforces the Act and may impose administrative fines and, for specific offences, criminal penalties.
A data controller must notify the Information Commission of a personal data breach no later than 72 hours after becoming aware of it, and a late notification must be accompanied by reasons. Where a breach is likely to affect a significant number of individuals and their rights and freedoms, the data controller must promptly inform the affected data subjects.
The Data Protection Act, 2023 establishes the Information Commission as the enforcing authority and requires every data controller and processor to process personal data lawfully under one of the grounds the Act lists, including consent, contractual necessity, a legal requirement, vital interests, public interest or legitimate interest. Consent must be informed, free and explicit, and a data subject may withdraw it at any time.
The Act applies to automated and semi-automatic processing generally and to non-automatic processing that forms part of a filing system within Seychelles, and it does not exempt processing of personal data that is otherwise publicly available.
Section 37 requires each data controller to maintain a record of all processing activities for which it is responsible. Each data processor must maintain a record of all processing activities carried out on behalf of a data controller. The controller and the processor must make the record available to the Commission upon request. Section 38 requires a controller, or a processor acting on its behalf, to keep logs for all processing operations.
The logs of consultation must make it possible to establish the justification for, and the date and time of, the consultation and, as far as possible, the identity of the person who consulted the data, and the logs of disclosure must make it possible to establish the justification for, and the date and time of, the disclosure and, as far as possible, the identity of the person who disclosed the data and of the recipients.
The logs may be used only for the purposes section 38(4) lists, the first of which is to verify the lawfulness of processing. The controller or processor must make the logs available to the Commission upon request.
Personal data may not be transferred outside Seychelles unless the recipient country's processor ensures a comparable level of protection for data subjects' rights and freedoms, assessed on a risk-based approach proportional to the threat, the harm's severity, the confidentiality of the information, and the number of affected data subjects. The Information Commission may prohibit a transfer where necessary in the public interest.
Section 30(2) empowers the Minister, in consultation with the Commission, to make regulations imposing suitable measures to safeguard a data subject's rights, freedoms and legitimate interests where a qualifying significant decision about them is taken solely on automated processing.
The Act does not itself state what those measures must be: it is a rule-making power rather than a right the data subject or a court can enforce directly, and it takes effect only once the Minister issues implementing regulations.
A data subject has the right to be informed of the use of their personal data, to access it, to have it rectified or deleted, to object to processing for a specific purpose, and to receive it in a structured, machine-readable and interoperable format for portability to another controller. Any person who suffers material or non-material damage from a contravention of the Act has a right to compensation from the data controller or processor responsible.
A data controller who, without lawful justification, discloses personal data in a manner incompatible with the purpose for which it was collected commits an offence, as does anyone who obstructs the Information Commission (a fine not exceeding SCR200,000 on summary conviction). Any other offence under the Act for which no specific penalty is provided carries imprisonment not exceeding two years or a fine at level 5 of the Standard Scale.
Separately, the Information Commission may impose an administrative fine, capped at SCR200,000 for most categories of infringement, calibrated to be effective, proportionate and dissuasive.
Processing of personal data relating to race, ethnic origin, biometrics, genetics, political opinions, religious or philosophical beliefs, or for identifying a person's health or sex life, is prohibited unless a specific exception applies, such as the data subject's explicit consent, protection of vital interests, or the data being manifestly made public by the data subject.
No person may process a child's personal data (a person below 18 years) without consent from the child's parent or legal guardian.
Scraping law2 instruments, 1 in force, 1 no longer in force
Research summary (203 words)
Seychelles' computer-misuse regime is the Cybercrimes and other Related Crimes Act, 2021 (Act 59 of 2021), which repealed the Computer Misuse Act, 1998 and criminalises unauthorised access to a computer system: access is unauthorised where the person is not entitled to control access of that kind and lacks consent from someone who is, a test that, on its plain wording, turns on entitlement and consent rather than on whether a page carries a technical access control, and no reported Seychellois case has tested how it applies to an unauthenticated, publicly available page.
The Act gives an electronic service provider limited criminal-liability safe harbours for mere conduit, caching and hosting activity, and its own investigatory-authority provisions permit accessing publicly available open-source stored computer data without further authorisation.
Seychelles' position on terms-of-service enforceability, a sui generis database right, an unfair-competition or misappropriation doctrine reaching scraping, and the legal weight of a robots.txt directive has not been established here.
The Data Protection Act, 2023 applies to personal data collected from Seychelles without a general carve-out for information that is otherwise publicly accessible, so scraping personal data from a public Seychellois website remains subject to that Act's lawful-basis and cross-border-transfer duties, tracked under this jurisdiction's privacy topic.
No longer in force.since repealed Repealed. The page is kept as a record.
Binds public and private bodies.
What this law does
The Computer Misuse Act, 1998 made it an offence to secure unauthorised access to a computer, or to a program or data held in a computer, punishable by a fine of R20,000 and imprisonment for five years, with an enhanced offence for unauthorised access with criminal intent. It was repealed on by the Cybercrimes and other Related Crimes Act, 2021, which restates and expands the same conduct.
A person who causes a computer system to perform a function with intent to secure unauthorised access to computer data held in it commits an offence, punishable by a fine at level 4 of the Standard Scale or imprisonment not exceeding 5 years, or both.
Access is unauthorised where the person is not entitled to control access of the kind in question and does not have consent from someone who is so entitled; it is immaterial whether the unauthorised access was directed at a particular program, a program or data of any kind, or a program or data held in a particular computer system.
The Act also criminalises access secured with criminal intent (up to 20 years' imprisonment), unauthorised interception, unauthorised interference with computer data or with a computer system's operation, and unlawful possession of illegal devices, each with its own penalty tier.
Seychelles has not enacted a dedicated Cybersecurity Act, a general product-security or connected-device statute, or a baseline reasonable-security duty reaching an ordinary software business.
The Department of Information Communications Technology (DICT) published a National Cybersecurity Policy in 2019 that calls for a future national governance structure, a national Computer Emergency Response Team (CERT), and a dedicated Cybersecurity Security Unit for the Civil Service, but it is a policy statement of intent rather than enacted law, and no subsequent gazette notice shows a Cybersecurity Act, a statutory CERT, or the governance structure it describes as having since been created; the data-protection legislation the same policy called for became the Data Protection Act, 2023, already this jurisdiction's privacy row.
The only cyber-risk duties found sit at the financial-sector regulator level.
The Central Bank of Seychelles issued Cyber Security Guidelines for deposit-taking financial institutions (banks and credit unions) on , a supervisory circular rather than a statutory instrument, setting out expected cyber security governance, risk assessment, incident-response and technical-control practices and requiring notification of a significant cyber security incident to CBS within 24 hours with a root-cause-analysis report within 14 days.
The Financial Services Authority's Virtual Asset Service Providers (Cyber Security Requirements) Regulations, 2024 (S.I. 71 of 2024), made under section 38(2)(f)(iv) of the Virtual Asset Service Providers Act, 2024 (Act 12 of 2024) and published in the Official Gazette on , is a genuine binding regulation: it applies to all VASP Act licensees, requires a cyber security strategy reviewed at least annually with the results reported to the board, systems and controls including penetration testing and vulnerability assessment (bi-annual in a licensee's first year, annual thereafter) by an FSA-approved independent auditor, notification of a cyber security risk to the FSA within 24 hours and a report within 5 working days for a successful attempt, and a business continuity plan, with administrative penalties reaching SCR4,000,000 plus SCR50,000 for each day of continuing contravention, up to twenty days, for the strategy duty alone.
The CBS guidelines bind a deposit-taking financial institution and are recorded in this summary so a reader knows they exist. Seychelles' computer-misuse law, the Cybercrimes and other Related Crimes Act, 2021 as amended by the Cybercrimes and Other Related Crimes (Amendment) Act, 2025 (Act 23 of 2025), binds an intruder against a system and sits in this jurisdiction's scraping topic rather than here.
The Virtual Asset Service Providers (Cyber Security Requirements) Regulations, 2024 require a licensee to have in place a cyber security strategy and impose systems, controls, audit and business continuity duties under regulations 4 to 6, 8 and 11. The same Regulations require a licensee that discovers a cyber security risk as a result of a cyber security event to notify the Authority of any attempt within 24 hours.
The Financial Services Authority's Guidance Notes for Cyber Security Audit, in the version of , cite regulation 5(3) of the Regulations as the source of the penetration-testing and vulnerability-assessment duty.
Regulation 13 of the National Payment System (Electronic Money) Regulations, 2022 requires an electronic money issuer to ensure that appropriate and robust security policies and measures intended to safeguard the integrity, authenticity and confidentiality of data and operating processes are in place.
Regulation 19 of the National Payment System (Electronic Money) Regulations, 2022 requires an electronic money issuer to report to the Central Bank of Seychelles any security breaches that may affect the safety and efficiency of the electronic money service.
The Regulations define an electronic money issuer as a person licensed as a payment service provider or approved by the Central Bank to issue electronic money. The Central Bank makes the Regulations in exercise of the powers conferred by section 42(1) of the National Payment System Act, 2014.
Regulation 13 requires an electronic money issuer to ensure that appropriate and robust security policies and measures intended to safeguard the integrity, authenticity and confidentiality of data and operating processes are in place. Regulation 13 requires an electronic money issuer to ensure that an effective audit function provides periodic review of the security control environment and critical systems.
Regulation 20 requires an electronic money issuer already in operation to comply within six months from the coming into force of the Regulations.
Regulation 3 applies the Regulations to all licensees under the Act. Regulation 4(1) requires a licensee to have in place a cyber security strategy for the establishment and maintenance of appropriate systems and controls for managing cyber security and operational risks. Regulation 4(9) requires a licensee to review its cyber security strategy and policy regularly, and at least annually.
Regulation 4(11) lets the Authority impose an administrative penalty of SCR4,000,000 and an additional SCR50,000 for each day or part of each day, not exceeding twenty days, for which a contravention of regulation 4 continues. Regulation 5(3)(a) requires penetration testing and vulnerability assessment of a licensee's systems on a bi-annual basis during the first year of licensing and at least once a year for subsequent years.
Regulation 5(4) requires a licensee, subject to the approval of the Authority, to appoint a qualified independent party to audit its systems and control as and when the Authority requires. Regulation 5(6) lets the Authority impose an administrative penalty of SCR2,000,000 and an additional SCR50,000 for each day or part of each day, not exceeding thirty days, for a contravention of regulation 5(3) or 5(4).
Regulation 6 requires a licensee to implement appropriate and effective arrangements to maintain the continuity of its operations. Regulation 8(1) requires a cyber security report, prepared by the fit and proper person responsible for information security, for the purpose of section 22(2) of the Act. Regulation 8(2) lets the Authority impose an administrative penalty of SCR 500,000 for a contravention of regulation 8.
Regulation 11(1) requires a licensee to have in place a formalized business continuity plan, as approved by its board of directors. Regulation 11(3) requires a licensee to review and test its business continuity plan at least every two years. Regulation 11(5) lets the Authority impose an administrative penalty of SCR 500,000 and an additional SCR50,000 for each day or part of each day, not exceeding thirty days, for a contravention of regulation 11.
Regulation 19 requires an electronic money issuer to report to the Central Bank any suspected fraud, any security breaches, material service interruption or other significant issues that may affect the safety and efficiency of the electronic money service. Regulation 18 requires an electronic money issuer to notify the Central Bank, and give details in writing, of any loss of confidential data.
The Schedule to the Regulations requires the statistical report to state the total number of service interruptions, system downtime and security breaches.
Regulation 7(1) requires a licensee that discovers a cyber security risk as a result of a cyber security event to notify the Authority of any attempt within 24 hours. Regulation 7(2) requires a licensee to provide a report within 5 working days for any successful attempt. Regulation 7(3) requires the report to include the remedial actions to mitigate cyber security risk and prevent a future cyber security event.
Regulation 2 defines a cyber security event as any act or attempt, successful or unsuccessful, to gain unauthorized access to disrupt, or misuse the electronic systems or information stored on such systems.
Seychelles has no press-publisher neighbouring right and no platform-to-publisher bargaining code; the Copyright Act, 2014 (Act No. 5 of 2014) is the only law reaching an aggregator's reproduction of Seychellois news content.
Section 6(b) excludes news of the day and miscellaneous facts having the character of mere items of press information from copyright protection altogether, while section 11 permits quotation from a lawfully published work, subject to a fair-practice and extent-justified test and an attribution requirement, and section 14 separately permits reproducing a newspaper or periodical article on current economic, political, or religious topics unless the right to authorise reproduction is expressly reserved, and permits reproducing short excerpts of a work in the course of reporting current events.
Willful, commercial-scale infringement of a reproduction right is a criminal offence, and the rights owner also has a civil right to an injunction and damages. No statute or reported Seychellois decision addresses hyperlinking, framing, hot-news misappropriation, or a machine-readable text-and-data-mining opt-out.
Section 6(b) excludes news of the day and miscellaneous facts having the character of mere items of press information from copyright protection. Section 11(1) permits quoting from a work that has lawfully been made available to the public without the copyright owner's authorisation, provided the quotation is compatible with fair practice and does not exceed the extent justified by the purpose.
Section 11(2) requires that the quotation be accompanied by an indication of source and the author's name where the name appears in the source. Section 14(a) permits reproducing, broadcasting, or otherwise communicating to the public an article published in a newspaper or periodical on a current economic, political, or religious topic, or a broadcast work of the same character.
This permission does not apply where the right to authorise reproduction is expressly reserved by the author or other copyright owner. Section 14(b) separately permits reproducing and broadcasting or otherwise communicating to the public short excerpts of a work seen or heard in the course of reporting current events, to the extent justified by that purpose.
Section 31(1) makes willful, commercial-scale infringement of a reproduction right an offence punishable on conviction by imprisonment of up to five years or a fine of up to SCR50,000, or both, rising to up to ten years or a fine of up to SCR100,000, or both, for a second or subsequent offence within five years. Section 30 separately entitles the rights owner to a court order requiring the infringer to desist and to damages and expenses.
Section 5(1)(b) also protects, as derivative works, collections of data including databases, whether in machine-readable or other form, provided the collection is original by reason of the selection or arrangement of its contents.
These areas of law were researched here and no instrument was recorded. Each finding says what the research checked, as of the date under it. It describes our search, not a guarantee that no such law exists.
AI law
Seychelles has not enacted a statute imposing an AI-specific duty on any person as of this date.
The Data Protection Act, 2023 gives the Minister power to make regulations safeguarding a data subject's rights where a qualifying significant decision about them is based solely on automated processing, and treats the underlying personal-data processing as the regulated activity rather than the use of an AI system as such; that duty is tracked under this jurisdiction's privacy topic rather than here.
As of .
Age gating law
Seychelles has no adult-content age-verification law, social-media minor-access restriction, app-store age-verification requirement, or age-appropriate design code as of this date.
The Cybercrimes and other Related Crimes Act, 2021 criminalises publishing, producing or possessing child pornography through a computer system and communicating with a person under 18 (or under 16 for certain offences) to facilitate specified crimes, defining a child as a person under 18 years, but these are criminal prohibitions on an individual's conduct rather than a verification or age-gating duty placed on a service provider or publisher.
As of .
Case law
No current case law for Seychelles AI law
No current case law for Seychelles privacy law
No current case law for Seychelles scraping law
No current case law for Seychelles cybersecurity law
No current case law for Seychelles communications law
No current case law for Seychelles content moderation law
No current case law for Seychelles product and AI liability law
No current case law for Seychelles digital accessibility law
No current case law for Seychelles age gating law
No current case law for Seychelles reuse law
Reporting clocks that run here3 instruments
The instruments whose obligation lines set a deadline for reporting an incident, a vulnerability or a personal-data breach, each deadline read from the sentence that carries it and listed shortest first. The law of the Seychelles comes first, then the law of the bodies above it that applies here.
Each flag is one law, and a link to it. Read down the scale: the clocks document's time axis, with the empty stretches shortened so the deadlines sit close. Flags on one line set the same duty at the same deadline, and the laws behind them are named to the right, with what each clock counts from.
The deadlines above on one time axis, shortest at the top. The axis keeps its order and, between neighbors, its proportion, but a stretch with no deadline on it is shortened, so the hour marks on the left are what say how far apart two stations really are. Beside each action, the laws that set it, what each counts from, and a status where the law is not yet in force. The List tab has the same data in full, with the sentences.
Notify the Authority within 24 hours of any attempt, where you discover a cyber security risk as a result of a cyber security event, meaning any act or attempt, successful or unsuccessful, to gain unauthorized access to, disrupt or misuse your electronic systems or the information on them (reg. 7(1)).
For a successful attempt, provide the Authority a report within 5 working days on whether the event affects or has affected the services or network and information systems that support your critical or important functions, the services you are authorized to provide, and whether it is or was malicious and unauthorized access to your network and information systems (reg. 7(2)).
Notify the Information Commission of a personal data breach no later than 72 hours after becoming aware of it, giving reasons for any later notification.
Promptly inform the affected data subjects where a breach is likely to affect a significant number of individuals and their rights and freedoms.
Submit a monthly statistical report to the Central Bank of Seychelles by the 15th of every month that includes the total number of incidents of fraud, theft and robbery and the total number of service interruptions, system downtime and security breaches, with the source of discovery, nature of incident, reasons and value of maximum exposure (reg. 17(a) and the Schedule).
Which of these one incident starts turns on the facts: the incident method works that through. The clocks document draws every clock in the LexLint law library on one axis, with the sentence beside every rung.
AIDrafted with AI
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made
This page covers the instruments LexLint has researched
to a stage. Instruments named in the law library but not yet researched are
counted in the head and are not listed here. Every entry carries its own
primary source on its note page. This is a research index, not legal
advice.
