🇸🇨Data Protection Act, 2023

← Back to laws in Seychelles

A modern accountability law with strong operational duties

The Seychelles Data Protection Act, 2023 is built around responsible and transparent processing of personal data. It protects individuals with regard to the processing of personal data, recognises the constitutional right to privacy, and promotes the responsible flow of information by private and public entities.

The Act is not a narrow consent law. Consent is important, but the law also recognises contractual necessity, legal obligation, vital interests, public interest, legitimate interests, administration of justice and emergency public functions. The operational burden is therefore to identify the correct ground, document the processing, inform the data subject, limit the processing to its purpose, secure the data, and maintain accountability across the lifecycle.

Scope — who and what the Act covers

Section 3 applies the Act to the processing of data through automatic or semi-automatic means, and to non-automatic processing within Seychelles where the data forms part of a filing system. The Act applies whether the relevant filing system is managed by a private or public data controller.

The Act does not apply to processing by relevant authorities in the course of a criminal investigation, matters that pertain to national security, or processing of personal data by a natural person for a personal activity. These are targeted exclusions. They do not remove ordinary public and private sector processing from the Act.

The Act defines personal data as any information relating to an identified or identifiable natural person. Processing includes collection, recording, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure, dissemination, making available, alignment, combination, restriction, erasure and destruction. The definitions are broad enough to cover most digital and filing-system processing operations.

The regulator — Information Commission

Section 5 makes the Information Commission the competent authority to enforce and implement the Act. The Commission's powers include enforcement, public awareness, complaint handling, investigations, audits and imposition of fines.

The Commission may issue rules and procedures, promote awareness among data controllers and processors, encourage self-regulation and certification mechanisms, exercise control over data processing operations, verify whether processing complies with the Act, advise public institutions, issue opinions, monitor technological and commercial developments, examine automated decision-making or data linkage proposals, and cooperate with supervisory authorities in other countries.

The Commission's enforcement powers are significant. It may investigate complaints or suspected offences, inspect documents, systems and premises, compel attendance and written statements, serve enforcement notices, issue reprimands, order compliance with data subject requests, order breach communication, restrict or ban processing, order rectification or erasure, impose administrative fines, suspend data flows and seek preservation orders from a court.

Lawful processing — consent plus other legal grounds

Section 15 requires data controllers and processors to adhere to principles of data quality, purpose limitation, use and further disclosure limitation, transparency, data subject participation, proportionality and accountability.

Personal data may be processed where the data subject has consented, where processing is necessary for contractual obligations, where a specific law requires processing, where it is necessary to protect vital interests, where it is conducted in the public interest under a supporting legal framework, where it responds to legitimate interests of the controller or a third party, or where processing is necessary for administration of justice or a public function in a state of emergency for the benefit of the data subject.

Where consent is required, it must be informed, free and explicit. Controllers must build policies, procedures and systems that allow consent to be given in an intelligible and user-friendly manner. Where data from different sources is combined, controllers must develop a layered consent approach, allowing data subjects to choose between categories of data and controllers based on specific processing purposes unless limiting the data would affect the purpose or the categories are complementary and contribute to data quality.

The Act also makes consent provable and revocable. Data subjects may withdraw consent at any time, and data controllers must be able to provide evidence of the data subject's consent. Controllers must not make supply of a product or service conditional on consent to processing beyond what is required to fulfil specified and lawful purposes.

Retention, minimisation and data quality

Section 16 requires personal data to be stored only for the period necessary to meet the processing purpose. After that period, data must be anonymised, archived and, where necessary, erased from the database. Controllers must adopt procedures and mechanisms so that data remains anonymous once the retention period has elapsed, using techniques such as data masking, pseudonymisation, encryption or removal of personally identifiable information.

Further retention may be lawful where necessary for freedom of expression and information, legal obligation, public interest tasks, official authority, public health, archiving in the public interest, scientific or historical research, statistical purposes, or the establishment, exercise or defence of legal claims.

Section 17 imposes data minimisation: personal data must be kept to the minimum necessary to meet the specified purposes. Section 18 requires personal data to be processed free of error, complete and up to date, and permits collection, use and disclosure only for specific and appropriate purposes of which the individual has been informed.

Special categories, minors and criminal data

Section 22 prohibits processing personal data relating to race, ethnic origin, biometrics, genetics, political opinions, religious or philosophical beliefs, health or sex life unless a listed exception applies. These exceptions include explicit consent, employment and social security obligations, vital interests, legitimate activities of certain not-for-profit bodies, data manifestly made public by the data subject, legal claims, substantial public interest, medical and health care purposes, public health, archiving, research and statistical purposes, and misconduct or inadequate behaviour.

Section 23 deals with minors. Personal data of a child below 18 years may not be processed unless consent is given by the child's parent or legal guardian. The controller must obtain or verify parental or guardian consent, taking available technology into account.

Section 24 restricts processing of personal data relating to criminal convictions, offences or related security measures. Such processing must occur only under the control of official authority or where authorised by law with appropriate safeguards for the rights and freedoms of the data subject.

Data subject rights — access, correction, deletion, objection and portability

Part V gives data subjects a broad rights framework. Rights may be exercised personally or through a legal or voluntary representative. Parents, custodians or guardians may exercise rights for minors and persons with mental disabilities.

Data subjects have the right to be informed about the legal basis for processing, retention period or criteria, recipients including recipients in other countries or international organisations, and further information necessary to exercise their rights. They have the right to access confirmation of processing, the personal data being processed, its origin, recipients, recipients who accessed the data in the past six months, processing purposes, legal basis, categories of data and storage period.

The Act also provides rights to rectification, correction, cancellation, deletion, erasure, restriction, objection and portability. Portability must be supported through structured, machine-readable and interoperable formats, and systems involving personal data must be designed to enable portability rights. Where portability is requested, the data controller must enable its API to be accessed by a third party where practicable.

Data subjects also have a right to compensation for material or non-material damage caused by contravention of the Act. Controllers are liable for damage caused by unlawful processing, while processors are liable where they breach obligations directed to processors or act outside or contrary to the controller's lawful instructions.

Controller and processor obligations

Section 33 makes the data controller responsible for personal data in its possession or control. The controller must designate one or more individuals responsible for ensuring compliance and make public the business contact information of at least one designated individual.

Section 34 requires transparency. Controllers and processors must make information publicly and persistently available in a clear and accessible manner and develop a privacy policy that accurately represents data processing and transfer activities. The policy must cover the type of information collected, processed and transferred, controller identity and contact details, categories of data and purposes, security measures, rights-exercise mechanisms and retention policies.

Section 35 imposes privacy by design and by default. Controllers must implement technical and organisational measures at the time processing means are determined and at the time of processing. The measures must implement data protection principles and integrate safeguards into processing. By default, only personal data necessary for each specific purpose may be processed, considering collection amount, processing extent, storage period and accessibility.

Section 36 governs processors. Controllers may use only processors that provide sufficient guarantees. Processor relationships must be governed by a written contract covering the subject matter and duration of processing, nature and purpose, data types, data subject categories, and rights and obligations. Processors must act only on controller instructions, ensure confidentiality, assist with data subject rights, delete or return data at the end of services, make compliance information available and follow rules for engaging sub-processors.

Records, logs, blocking and DPIAs

Section 37 requires controllers and processors to maintain records of processing activities. Controller records must include contact details, DPO details where applicable, processing purposes, recipient categories, data subject and data categories, profiling, transfers, legal bases, retention limits and security measures. Processor records must include processor and controller contact details, DPO details where applicable, processing activities, transfer details and security measures. These records must be available to the Commission on request.

Section 38 requires logs for all processing operations. Consultation logs must show the justification, date, time and, as far as possible, identity of the person who consulted the data. Disclosure logs must show the justification, date, time, identity of the person who disclosed the data and identity of recipients. Logs may be used to verify lawfulness, support self-monitoring, ensure integrity and security, and support criminal proceedings.

Section 39 requires blocking of access when data becomes subject to rectification or erasure. Section 40 requires a DPIA before high-risk processing, including systematic and extensive automated evaluation or profiling producing legal or significant effects, large-scale processing of special categories of data, large-scale monitoring of publicly accessible areas, and other circumstances specified by the Commission. Section 41 requires prior consultation with the Commission where the DPIA indicates high risk.

Security and breach notification

Section 42 requires controllers and processors to implement appropriate technical and organisational security measures. These include pseudonymisation and encryption, ongoing confidentiality, integrity, availability and resilience, restoration of availability and access after physical or technical incidents, and regular testing and evaluation of security measures.

The Act specifically requires systems used in processing to function properly and, in case of interruption, be restored within the minimum possible timeframe and in any case not exceeding 72 hours. Controllers and processors must also prevent unauthorised processing, unauthorised interference and data corruption arising from malfunction or cyber vulnerability.

Section 43 requires the data controller to notify the Commission of a personal data breach no later than 72 hours after becoming aware of it. Late notification must include reasons for the delay. The notification must describe the nature of the breach, categories and approximate number of data subjects and records, DPO or contact-point details, likely consequences, and measures taken or proposed.

Section 44 requires communication to data subjects where a breach is likely to affect a significant number of individuals and their rights and freedoms. Communication may not be required where appropriate technological and organisational protection measures were applied, subsequent measures eliminate likely risk, or direct communication would involve disproportionate effort and public communication provides equivalent notice.

Data protection officers

Section 45 requires designation of a data protection officer where the core activities of the controller or processor involve regular and systematic monitoring of data subjects on a large scale, or large-scale processing of special categories of data. Other organisations may designate a DPO voluntarily, and the same person may serve several controllers depending on structure and size.

Section 46 makes the DPO responsible for monitoring compliance with the controller's personal data protection policies and with the Act. The DPO acts as the contact point for the Commission in relation to processing, consultation, investigations and audits, and also acts as the main focal point for data subject complaints.

Cross-border transfers

Section 47 prohibits transfer of personal data outside Seychelles unless the recipient country or territory ensures a comparable level of protection for the rights and freedoms of data subjects. In assessing comparable protection, the Commission considers the nature of the personal data, purposes and processing period, destination law, cross-border privacy rules schemes and international data protection agreements signed by the controller in the destination country.

Special rules apply to personal data of Seychellois citizens relating to special categories. Such processing requires a designated controller accountable for cross-border processing in Seychelles, intra-group transfer where the headquarters is outside Seychelles, data subject information about the processing location and other required details, or necessity to protect vital interests. The Commission may authorise transfers under cross-border privacy rules systems and may prohibit transfers where necessary in the public interest.

Offences, penalties and transition

Section 48 creates offences for unlawful disclosure of personal data by controllers and processors, unauthorised access to personal data, disclosure to persons not entitled to access it, and offering to sell personal data obtained in breach of the Act. Section 49 creates an obstruction offence punishable on summary conviction by a fine not exceeding SCR 200,000.

Section 50 provides that offences without a specific penalty, or other contraventions of the Act, may lead to imprisonment not exceeding two years or a fine of level 5 on the Standard Scale. Courts may also order forfeiture of equipment or prohibit or require acts to stop continuing contraventions. Section 51 requires administrative fines to be effective, proportionate and dissuasive, taking into account factors such as nature, gravity, duration, intention or negligence, mitigation, responsibility, previous infringements, cooperation, data categories and how the infringement became known.

Section 56 gives existing controllers and processors an 18-month transition period from commencement to bring existing processing into conformity with the Act. Failure to comply with that transition obligation is itself an offence.