Seychelles

Section 15(2) lists the grounds on which personal data may be processed, including the data subject's consent. Sections 26-32 give data subjects the right to be informed, to access, rectify, delete, object, port their data and to compensation. Controllers must keep a record of processing activities (s. 37(1)).

Section 43(1) requires the controller to notify the Information Commission of a breach not later than 72 hours after becoming aware of it. Under s. 44(1), where a breach is likely to affect a significant number of individuals the controller must promptly inform the affected data subjects.