🇸🇨Seychelles

Seychelles now has a modern, rights-based data protection framework

Seychelles' data protection regime is anchored by the Data Protection Act, 2023, Act 24 of 2023. The Act recognises the constitutional right to privacy under Article 20 of the Constitution and creates a comprehensive framework for the processing of personal data by public and private entities.

The Act is much closer to a modern accountability model than to an older notice-only privacy law. It combines lawful processing grounds, data minimisation, retention limits, special-category restrictions, data subject rights, breach notification, data protection impact assessments, processor contracts, records of processing, privacy by design, data protection officers and cross-border transfer controls.

The three ideas to understand first

The Information Commission is the competent authority. The Information Commission, established under the Access to Information Act, is the authority responsible for enforcing and implementing the Data Protection Act. It may investigate, audit, issue enforcement notices, impose corrective measures, order restrictions on processing, suspend transfers, impose administrative fines and cooperate with foreign supervisory authorities.

The Act applies across public and private processing. It applies to data processed through automatic or semi-automatic means and to non-automated processing within Seychelles where the data forms part of a filing system. The Act covers processing by private and public data controllers. It excludes processing by relevant authorities in criminal investigations, national security matters, and personal activity processing by a natural person.

Accountability is built into the operating model. Data controllers and processors must not only comply with processing principles. They must maintain records, logs, privacy policies, processor contracts, security measures, DPIAs where high-risk processing is involved, breach response workflows and mechanisms for data subjects to exercise rights.

How the Act works in practice

The Act defines personal data as any information relating to an identified or identifiable natural person. Processing is broad and includes collection, recording, structuring, storage, alteration, retrieval, use, disclosure, dissemination, restriction, erasure and destruction. Sensitive personal data is treated as a special category because misuse may lead to discrimination or serious risk to the data subject.

Processing must be grounded in the Act's principles: data quality, purpose limitation, use and further disclosure limitation, transparency, data subject participation, proportionality and accountability. Personal data may be processed on grounds such as consent, contractual necessity, legal obligation, vital interests, public interest, legitimate interests, administration of justice or public functions in a state of emergency.

Consent receives detailed treatment. Where consent is required, it must be informed, free and explicit. Controllers must make consent intelligible and user-friendly, support layered consent when combining data from different sources, allow withdrawal, avoid forced consent beyond what is required for the specified lawful purpose, and be able to prove that the data subject consented.

What organisations should prioritise

Start with a processing inventory. The Act requires records of processing activities, and those records must contain purposes, categories of data subjects and personal data, recipients, transfers, legal bases, retention periods, security measures and, where applicable, profiling. This inventory is also the foundation for privacy notices, transfer decisions, DPIAs and breach response.

Then review the rights workflow. Data subjects have rights to be informed, access data, obtain rectification, request deletion, object to specific processing, seek portability and claim compensation. The Act expects information to be provided in clear and accessible form, free of charge unless requests are manifestly unfounded or excessive.

Finally, build the accountability layer. This means documented policies, privacy by design, processor contracts, logging, blocking of data subject to rectification or erasure, DPIAs for high-risk processing, breach notification to the Commission within 72 hours, breach communication to data subjects where required, and appointment of a data protection officer for large-scale monitoring or large-scale special-category processing.