Data protection & privacy laws in Seychelles (2026)

The Data Protection Act, 2023 (Act 24 of 2023) came into force on 22 December 2023, replacing the earlier 2003 Act (modelled on the UK 1984 Act) that was enacted but never brought into practical operation.

The Information Commission is the statutory body designated to implement, monitor and enforce the Act, empowered to conduct audits and investigations and to impose penalties on non-compliant entities.

Individuals have rights of access, rectification, erasure, restriction and objection to processing, withdrawal of consent, compensation for unlawful processing, and the right to lodge a complaint with the Information Commission.

Controllers and processors must adopt privacy policies, report data breaches promptly to the Commission and affected individuals, conduct Data Protection Impact Assessments for high-risk processing, and certain entities must appoint a Data Protection Officer.

The 2023 Act is a modern, GDPR-influenced framework aimed at aligning Seychelles with international data-protection standards, a notable upgrade from the obsolete 2003 regime.

Existing data controllers and processors were given an 18-month transitional period from 22 December 2023 (ending around June 2025) to bring their activities into conformity with the Act.