Seychelles

Seychelles has an in-force comprehensive data protection law. The Data Protection Act, 2023, passed in December 2023, modernised the framework for privacy and personal data protection and replaced the country's earlier (and only partially operative) 2003 statute; controllers and processors were given an 18-month transition from 22 December 2023. The Act is now recorded in ATLPF's Instruments database (AI-draft). The Act designates the Information Commission as the statutory supervisory authority, now recorded in ATLPF's Regulators database, with powers to make rules, conduct investigations and audits, raise public awareness, impose fines, seek court injunctions, issue enforcement notices, and cooperate with foreign authorities. This is a marked step up from the limited enforcement under the 2003 framework. With both the Act and a named, functioning regulator now documented, Seychelles is scored in line with comparable single-instrument jurisdictions. The records are AI-drafted from a June 2026 verification search; the detailed substantive provisions (rights catalogue, sensitive-data categories, breach-notification timelines, transfer mechanisms) await confirmation against the official text.