Seychelles

A data controller must notify the Information Commission of a personal data breach no later than 72 hours after becoming aware of it, and a late notification must be accompanied by reasons. Where a breach is likely to affect a significant number of individuals and their rights and freedoms, the data controller must promptly inform the affected data subjects.

The Data Protection Act, 2023 establishes the Information Commission as the enforcing authority and requires every data controller and processor to process personal data lawfully under one of the grounds the Act lists, including consent, contractual necessity, a legal requirement, vital interests, public interest or legitimate interest. Consent must be informed, free and explicit, and a data subject may withdraw it at any time.

The Act applies to automated and semi-automatic processing generally and to non-automatic processing that forms part of a filing system within Seychelles, and it does not exempt processing of personal data that is otherwise publicly available.

Personal data may not be transferred outside Seychelles unless the recipient country's processor ensures a comparable level of protection for data subjects' rights and freedoms, assessed on a risk-based approach proportional to the threat, the harm's severity, the confidentiality of the information, and the number of affected data subjects. The Information Commission may prohibit a transfer where necessary in the public interest.

A data subject has the right to be informed of the use of their personal data, to access it, to have it rectified or deleted, to object to processing for a specific purpose, and to receive it in a structured, machine-readable and interoperable format for portability to another controller. The Minister may make regulations to safeguard a data subject's rights in connection with a decision based solely on automated processing.

Any person who suffers material or non-material damage from a contravention of the Act has a right to compensation from the data controller or processor responsible.

A data controller who, without lawful justification, discloses personal data in a manner incompatible with the purpose for which it was collected commits an offence, as does anyone who obstructs the Information Commission (a fine not exceeding SCR200,000 on summary conviction). Any other offence under the Act for which no specific penalty is provided carries imprisonment not exceeding two years or a fine at level 5 of the Standard Scale.

Separately, the Information Commission may impose an administrative fine, capped at SCR200,000 for most categories of infringement, calibrated to be effective, proportionate and dissuasive.

Processing of personal data relating to race, ethnic origin, biometrics, genetics, political opinions, religious or philosophical beliefs, or for identifying a person's health or sex life, is prohibited unless a specific exception applies, such as the data subject's explicit consent, protection of vital interests, or the data being manifestly made public by the data subject.

No person may process a child's personal data (a person below 18 years) without consent from the child's parent or legal guardian.

A person who causes a computer system to perform a function with intent to secure unauthorised access to computer data held in it commits an offence, punishable by a fine at level 4 of the Standard Scale or imprisonment not exceeding 5 years, or both.

Access is unauthorised where the person is not entitled to control access of the kind in question and does not have consent from someone who is so entitled; it is immaterial whether the unauthorised access was directed at a particular program, a program or data of any kind, or a program or data held in a particular computer system.

The Act also criminalises access secured with criminal intent (up to 20 years' imprisonment), unauthorised interception, unauthorised interference with computer data or with a computer system's operation, and unlawful possession of illegal devices, each with its own penalty tier.

Section 6(b) excludes news of the day and miscellaneous facts having the character of mere items of press information from copyright protection. Section 11(1) permits quoting from a work that has lawfully been made available to the public without the copyright owner's authorisation, provided the quotation is compatible with fair practice and does not exceed the extent justified by the purpose.

Section 11(2) requires that the quotation be accompanied by an indication of source and the author's name where the name appears in the source. Section 14(a) permits reproducing, broadcasting, or otherwise communicating to the public an article published in a newspaper or periodical on a current economic, political, or religious topic, or a broadcast work of the same character.

This permission does not apply where the right to authorise reproduction is expressly reserved by the author or other copyright owner. Section 14(b) separately permits reproducing and broadcasting or otherwise communicating to the public short excerpts of a work seen or heard in the course of reporting current events, to the extent justified by that purpose.

Section 31(1) makes willful, commercial-scale infringement of a reproduction right an offence punishable on conviction by imprisonment of up to five years or a fine of up to SCR50,000, or both, rising to up to ten years or a fine of up to SCR100,000, or both, for a second or subsequent offence within five years. Section 30 separately entitles the rights owner to a court order requiring the infringer to desist and to damages and expenses.

Section 5(1)(b) also protects, as derivative works, collections of data including databases, whether in machine-readable or other form, provided the collection is original by reason of the selection or arrangement of its contents.