Data Protection Act, 2023 (Act 24 of 2023)

[22nd December 2023] Data Protection Act REPUBLIC OF SEYCHELLES SUPPLEMENT TO OFFICIAL GAZETTE ACT

# DATA PROTECTION ACT, 2023 (Act 24 of 2023)

# ARRANGEMENT OF SECTIONS

# PART I - PRELIMINARY

Sections

1. Short title
2. Interpretation
3. Application
4. Exemptions

# PART II - INFORMATION COMMISSION 5. Information Commission 6. Powers and duties of Commission 7. Investigations and audits 8. Enforcement notice and corrective powers 9. Preliminary injunction 10. Disclosure 11. Liability 12. Powers and duties of Chief Executive Officer 13. Right of appeal 14. Cooperation

# PART III - DATA PROTECTION 15. Processing personal data 16. Data retention 17. Data minimization 18. Data quality 19. Access, requests and correction of data 20. Data security and confidentiality 21. Accountability for data processing activities

# PART IV - PROCESSING SPECIAL CATEGORIES OF PERSONAL DATA 22. Sensitive data 23. Data related to minors 24. Processing of personal data relating to offences and criminal conviction

[22nd December 2023] Data Protection Act REPUBLIC OF SEYCHELLES SUPPLEMENT TO OFFICIAL GAZETTE ACT

PART V - DATA SUBJECTS RIGHTS

1. Rights of data subjects
2. Right to be informed
3. Right to access data
4. Right of rectification or correction
5. Right to cancel or delete data
6. Right to object the processing of data for a specific purpose
7. Right to data portability
8. Right to compensation

PART VI - OBLIGATIONS OF DATA CONTROLLERS AND DATA PROCESSORS

1. Safe custody
2. Transparency
3. Privacy by design
4. Data processors
5. Records of processing activities
6. Logging
7. Blocking data
8. Data protection impact assessment
9. Prior consultation
10. Security of processing
11. Notification of a personal data breach to the Commission
12. Communication of a personal data breach to the data subject
13. Data protection officer
14. Tasks of data protection officer

PART VII - TRANSFER OF DATA TO THIRD PARTIES

1. Cross-border data flows

PART VIII - OFFENCES AND PENALTIES

1. Unlawful disclosure of personal data
2. Obstruction
3. Offence for which no penalty provided
4. General conditions for imposing administrative fines

[22nd December 2023] Data Protection Act 630 REPUBLIC OF SEYCHELLES SUPPLEMENT TO OFFICIAL GAZETTE ACT

# PART IX - MISCELLANEOUS

1. Cooperation with other authorities
2. Compliance audit
3. Regulations
4. Repeal of (Cap 57)
5. Transitional Provisions

[22nd December 2023] Data Protection Act REPUBLIC OF SEYCHELLES SUPPLEMENT TO OFFICIAL GAZETTE ACT

!img-0.jpeg

# DATA PROTECTION ACT, 2023

(Act 24 of 2023)

!img-1.jpeg

I assent

!img-2.jpeg

Wavel Ramkalawan President

$19^{th}$ December, 2023

AN ACT FOR THE PROTECTION OF INDIVIDUALS WITH REGARD TO THE PROCESSING OF PERSONAL DATA, TO RECOGNISE THE RIGHT TO PRIVACY ENVISAGED IN ARTICLE 20 OF THE CONSTITUTION, TO PROMOTE AND FACILITATE RESPONSIBLE AND TRANSPARENT FLOW OF INFORMATION BY PRIVATE AND PUBLIC ENTITIES AND TO PROVIDE FOR OTHER RELATED MATTERS.

ENACTED by the President and the National Assembly.

# PART I - PRELIMINARY

Short title

1. This Act may be cited as the Data Protection Act, 2023.

[22nd December 2023] REPUBLIC OF SEYCHELLES