Not publishable as-is. 2 of 6 publication_gate checks fail. The renderer displays the gate rather than suppressing it. Legal review and sub-brief approval are informational and are not part of this test.
Based mainly on secondary sources. Only 2 of the sources retrieved for this jurisdiction are official or direct reporting of official material (tier 1 or 2), against the 3 we look for. No finding on this page is shown with confidence above “Uncertain” until stronger sources are retrieved.
SC Data Protection & Privacy Regulation
SCschema gdpri-v2trajectory: not yet assessedregulated (omnibus)
Last updated · 10 categories · 27
claims · 9 sources in the cumulative register
The commencement status of the Data Protection Act, 2023 (Act 24 of 2023) in Seychelles is genuinely disputed between two sources of differing authority.
Data collected · Data published
AI-assembled from cited sources
Not covered: Sectoral Watch, AdTech & Commercial Privacy, Algorithmic, Biometric & Surveillance Governance, Children & Vulnerable Groups. Not fully checked this cycle: Controller/Processor Duties, Enforcement & Redress (4 open gaps).
Evidence re-verified:·Position last changed:·Record history & provenance ▾
Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently.
Traffic-light mix(sums to 10 rendered categories; click to filter)
Jurisdiction lead brief
Standing brief, as of 18 October 2026.
Lead Signal
The commencement status of the Data Protection Act, 2023 (Act 24 of 2023) in Seychelles is genuinely disputed between two sources of differing authority. The Information Commission of Seychelles' own current site states that the Act came into effect following its passage in December 2023, which, as the designated independent supervisory authority responsible for overseeing implementation and enforcement of the Act, would ordinarily be treated as authoritative. A secondary legal directory, however, states that the Act has not been brought into force yet, with data protection in the interim said to continue being governed by Civil Code privacy principles and sectoral statutes. These two accounts cannot both be correct, and no primary Gazette commencement notice has been retrieved to resolve the question. The practical consequence of this dispute is significant: whether Seychelles currently has a functioning, enforceable statutory data protection regime, or whether it remains in a pre-commencement period governed by general civil-law privacy principles, bears directly on every other module of the Act's substantive content.
Other Developments
The Information Commission is confirmed as the designated regulator regardless of the commencement dispute. The Information Commission, headed by the Information Commissioner assisted by two Commissioners, is designated as the independent supervisory authority responsible for overseeing implementation and enforcement of the Data Protection Act, 2023. This institutional designation is not itself disputed; the disagreement is confined to whether the Act the Commission is designated to enforce has actually entered into force.
Cross-Monitor Connections
The disputed commencement status of Seychelles' data protection regime has a bearing on how financial-integrity assessments of the jurisdiction's compliance infrastructure are read, to the extent data-handling and cross-border-transfer obligations intersect with beneficial-ownership and customer-due-diligence data flows; readers tracking that intersection should consult the financial-integrity monitor directly rather than treating this brief as resolving it.
Outlook
Resolution of the commencement dispute depends on retrieval of a primary Gazette commencement notice, which has not yet been located. Until such a notice is identified, the regulator's own assertion of current effect and a contrary secondary-source assertion both remain live and unreconciled; any operational reliance on the Act's current applicability should be treated with that unresolved dispute in mind.
Key regulatory facts for SC
Regulatory Dimension
SC Standing Position
Jurisdiction
SC (SC)
Regulatory Scope
Data Protection & Privacy Regulation (10 modules, 27 sourced findings)
Regulator & Framework
Core instrument, regulator identity, commencement date and headline scope are confirmed from a reputable compliance-commentary source, but pinpoint statutory provisions for territorial scope and registration/filing...
Lawful Processing & Special Data
Existence of a lawful-basis/principles framework is confirmed at headline level only; no pinpoint provisions for consent, special categories, or pseudonymisation were recoverable.
Data Subject Rights
Headline catalogue of rights is confirmed; procedural detail (deadlines, extension mechanics, minors' independent exercise age) is unverified.
Controller/Processor Duties
DPIA and DPO obligations are confirmed in principle; thresholds, ROPA exemptions, and the breach-notification regime (risk threshold, deadline, content) are unverified gaps.
Primary Instruments Cited
OneTrust DataGuidance, SC Official Instrument (dlapiperdataprotection.com index-html-t-law-c-SC), DLA Piper, Official Journal of the European Union, TechHive Advisory
Last Confirmed / Updated
2026-10-25 (9 sources in cumulative register)
10 of 10 categories
Signal
Density
Selections OR within a group, AND across groups. Press / to search.
Core instrument, regulator identity, commencement date and headline scope are confirmed from a reputable compliance-commentary source, but pinpoint statutory provisions for territorial scope and registration/filing duties are unverified.
Supervisory authorityInformation Commission of Seychelles
Traffic-light rationale — GreenCore instrument, regulator identity, commencement date and headline scope are confirmed from a reputable compliance-commentary source, but pinpoint statutory provisions for territorial scope and registration/filing duties are unverified.
Sub-modules (5)
Regulator And AuthorityGreen
The Information Commission of Seychelles is the Act's designated competent authority with enforcement and fining powers.
Claims (2):
The Information Commission of Seychelles is the competent authority under the Data Protection Act, 2023, with power to enforce and implement the Act and to impose fines on controllers/processors.
Information Commission of Seychelles — Headed by an Information Commissioner assisted by two Commissioners, responsible for oversight and enforcement under the Data Protection Act, 2023.
Act And InstrumentsGreen
The Data Protection Act, 2023 was gazetted and commenced 22 December 2023, replacing the 2003 Act, with an 18-month transitional period for compliance.
Claims (4):
The Data Protection Act, 2023 was published in the Official Gazette of Seychelles on 22 December 2023 and entered into force the same day, repealing and replacing the Data Protection Act, 2003.
The Act afforded data controllers and processors an 18-month transitional period from the 22 December 2023 commencement date to bring processing activities into conformity, a window that has now elapsed.
Data Protection Act, 2023 (Act 24 of 2023) — Came into force 22 Dec 2023, replacing the Data Protection Act, 2003.
Data Protection Act, 2023 (Act 24 of 2023) — A conflicting secondary source (DLA Piper) states the Act 'has not been brought into force yet', pending which data protection continues to be governed by Civil Code privacy principles and sectoral statutes.
Material ScopeGreen
The Act binds public and private sector controllers/processors, subject to criminal-investigation, national-security and personal/household exemptions.
Claims (3):
The Act applies to the processing of personal data by both public- and private-sector controllers and processors in Seychelles.
The Act exempts from its scope the processing of personal data by authorities in the course of a criminal investigation, matters of national security, and processing by a natural person for a purely personal activity.
Data Protection Act, 2023 (Seychelles) s.3 — Applies to processing of personal data through automated or semi-automated means, or where data form part of a filing system, within Seychelles; excludes criminal-investigation, national-security, and purely personal processing.
Territorial ScopeRed
No pinpoint provision on extraterritorial/targeting-and-monitoring application or household/law-enforcement exclusion drafting could be located. Searched: 'Seychelles Data Protection Act 2023 territorial scope', 'seylii.org Data Protection Act 2023 Seychelles'. Absent field provenance: primary Act text not reachable via available search/allowlist.
Regulator Registration And FilingRed
No registration, notification, or fee-duty provision for controllers was located in available sources. Searched: 'Seychelles Information Commission website data protection commissioner office', 'Seychelles Data Protection Act 2023 full text sections'. Absent field provenance: no primary or secondary source surfaced a registration/fee regime for Seychelles.
Category narrative138 words
Seychelles' comprehensive data-protection framework is the Data Protection Act, 2023, which repealed and replaced the Data Protection Act, 2003. The Act was gazetted and entered into force on 22 December 2023, with an 18-month transitional compliance period for controllers/processors that has since elapsed (around 22 June 2025), meaning the regime is now fully operative. The Information Commission of Seychelles is designated as the competent regulator, empowered to enforce and implement the Act, including imposing fines. The Act applies to both public and private sector processing, carved out from criminal-investigation, national-security, and purely personal/household processing. Pinpoint section numbers for material/territorial scope tests (establishment, targeting/monitoring limbs), the representative-appointment duty, and registration/filing/fee obligations could not be located from the available secondary commentary; no primary-source access (official gazette, seylii.org, or a verified Information Commission website) was reachable via search in this pass.
Sources and claims (9)
UncertainOneTrust DataGuidance — The Information Commission of Seychelles is the competent authority under the Data Protection Act, 2023, with power to enforce and implement the Act and to impose fines on controllers/processors.observed
UncertainOneTrust DataGuidance — The Data Protection Act, 2023 was published in the Official Gazette of Seychelles on 22 December 2023 and entered into force the same day, repealing and replacing the Data Protection Act, 2003.observed
UncertainOneTrust DataGuidance — The Act afforded data controllers and processors an 18-month transitional period from the 22 December 2023 commencement date to bring processing activities into conformity, a window that has now elapsed.observed
UncertainOneTrust DataGuidance — The Act applies to the processing of personal data by both public- and private-sector controllers and processors in Seychelles.observed
UncertainOneTrust DataGuidance — The Act exempts from its scope the processing of personal data by authorities in the course of a criminal investigation, matters of national security, and processing by a natural person for a purely personal activity.observed
DisputedDLA Piper — Data Protection Act, 2023 (Act 24 of 2023) — A conflicting secondary source (DLA Piper) states the Act 'has not been brought into force yet', pending which data protection continues to be governed by Civil Code privacy principles and sectoral statutes.observed
UncertainOneTrust DataGuidance — Information Commission of Seychelles — Headed by an Information Commissioner assisted by two Commissioners, responsible for oversight and enforcement under the Data Protection Act, 2023.observed
UncertainPrimary statutory record — Data Protection Act, 2023 (Seychelles) s.3 — Applies to processing of personal data through automated or semi-automated means, or where data form part of a filing system, within Seychelles; excludes criminal-investigation, national-security, and purely personal processing.
Existence of a lawful-basis/principles framework is confirmed at headline level only; no pinpoint provisions for consent, special categories, or pseudonymisation were recoverable.
Supervisory authorityInformation Commission of Seychelles
Traffic-light rationale — AmberExistence of a lawful-basis/principles framework is confirmed at headline level only; no pinpoint provisions for consent, special categories, or pseudonymisation were recoverable.
D2 · Lawful Processing — Full Module Record4 sub-modules · 73 words · 1 traced claims · Re-verified 2026-10-25
The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).
Supervisory authorityInformation Commission of Seychelles
Traffic-light rationale — AmberHeadline catalogue of rights is confirmed; procedural detail (deadlines, extension mechanics, minors' independent exercise age) is unverified.
Sub-modules (5)
Access RightAmber
The Act provides data subjects a right to be informed and a right of access to their personal data.
Claims (1):
Data subjects under the Act have the right to be informed of processing and a right of access to their personal data held by a controller.
Rectification And ErasureAmber
The Act provides rights to rectification and deletion of personal data.
Claims (1):
Data subjects under the Act have rights to rectification and deletion (erasure) of their personal data.
Restriction And ObjectionAmber
The Act provides a right to object to the processing of personal data; the compelling-legitimate-grounds test and absolute marketing-objection right are not pinpointed.
Claims (1):
Data subjects under the Act have the right to object to the processing of their personal data.
Data PortabilityAmber
The Act provides a right to data portability.
Claims (1):
Data subjects under the Act have a right to data portability of their personal data.
Deadlines And Response WindowsRed
No statutory response deadline, extension test/length, or fee/manifestly-unfounded test was located. Searched: 'Seychelles Data Protection Act 2023 full text sections breach notification penalties' (also covering response-window content); no pinpoint surfaced. Absent field provenance noted.
Category narrative48 words
The Act grants data subjects the right to be informed, access, rectification, deletion (erasure), objection to processing, data portability, and compensation. Statutory response deadlines, extension tests, the manifestly-unfounded-or-excessive fee test, and the age at which a minor may exercise rights independently could not be located from reachable sources.
Sources and claims (4)
UncertainOneTrust DataGuidance — Data subjects under the Act have the right to be informed of processing and a right of access to their personal data held by a controller.observed
UncertainOneTrust DataGuidance — Data subjects under the Act have rights to rectification and deletion (erasure) of their personal data.observed
UncertainOneTrust DataGuidance — Data subjects under the Act have the right to object to the processing of their personal data.observed
UncertainOneTrust DataGuidance — Data subjects under the Act have a right to data portability of their personal data.observed
DPIA and DPO obligations are confirmed in principle; thresholds, ROPA exemptions, and the breach-notification regime (risk threshold, deadline, content) are unverified gaps.
Supervisory authorityInformation Commission of Seychelles
Traffic-light rationale — AmberDPIA and DPO obligations are confirmed in principle; thresholds, ROPA exemptions, and the breach-notification regime (risk threshold, deadline, content) are unverified gaps.
D4 · Controller & Processor — Full Module Record7 sub-modules · 53 words · 4 traced claims · Re-verified 2026-10-25
The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).
The statutory transfer-restriction power is confirmed; adequacy status, SCC/BCR equivalents, TIA requirements, and data-localisation provisions remain unverified gaps.
Supervisory authorityInformation Commission of Seychelles
Traffic-light rationale — AmberThe statutory transfer-restriction power is confirmed; adequacy status, SCC/BCR equivalents, TIA requirements, and data-localisation provisions remain unverified gaps.
D5 · Cross-Border & Adequacy — Full Module Record6 sub-modules · 92 words · 3 traced claims · Re-verified 2026-10-25
The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).
No sectoral overlay or data-access/sharing scheme could be evidenced from reachable sources; this is recorded as an explicit gap rather than a silent omission.
Traffic-light rationale — Not assessedNo sectoral overlay or data-access/sharing scheme could be evidenced from reachable sources; this is recorded as an explicit gap rather than a silent omission.
Sub-modules (8)
Financial Sector OverlayRed
No Seychelles banking-secrecy or open-banking data-access overlay to the general DP regime was located.
Health Sector OverlayRed
No health-sector-specific data rule was located.
Telecoms And EprivacyRed
No national ePrivacy-equivalent transposition for communications traffic/location data was located.
Employment DataRed
No employment-context data provision was located.
Credit And ScoringRed
No credit-scoring-specific rule was located.
EducationRed
No education-sector-specific rule was located.
InsuranceRed
No insurance-sector-specific rule was located.
Data Access SharingRed
No local data-access, smart-data, or data-portability scheme analogous to the EU Data Act was located for Seychelles.
Category narrative88 words
No sector-specific data-protection overlays (financial/banking-secrecy, health, telecoms/eProvacy traffic-data retention, employment-specific, credit-scoring, education, insurance) or a horizontal data-access/data-sharing scheme analogous to the EU Data Act were identified for Seychelles in this research pass. Searched: 'Seychelles Information Commission ICT data protection commissioner appointed', 'seychellesnewsagency Data Protection Act Information Commission 2023 2024', general Seychelles Data Protection Act overview searches. As a non-EU jurisdiction, the EU Data Act (Regulation (EU) 2023/2854) does not itself bind Seychelles domestic controllers absent an EU-market-facing nexus, and no such nexus or local equivalent scheme was found.
No adtech-specific sub-regime evidenced; recorded as an explicit gap.
Traffic-light rationale — Not assessedNo adtech-specific sub-regime evidenced; recorded as an explicit gap.
Sub-modules (6)
Cookies And TrackersRed
No pinpoint cookie/tracker consent provision was located for Seychelles.
Dark PatternsRed
No dark-pattern prohibition was located.
Opt Out SignalsRed
No opt-out-signal (e.g., GPC-equivalent) regime was located.
Clean Rooms And DcrRed
No clean-room/data-collaboration rule was located.
Cross Context AdvertisingRed
No cross-context-advertising-specific rule was located.
Direct MarketingRed
No direct-marketing consent/suppression rule specific to Seychelles was located, beyond the Act's general objection right noted under data_subject_rights.
Category narrative39 words
No cookie/tracker-specific provision, dark-pattern prohibition, opt-out-signal regime, clean-room rule, or direct-marketing consent/suppression rule specific to Seychelles was identified. Searched: general Seychelles Data Protection Act overview and enforcement searches; no ePrivacy-style instrument or regulator guidance on cookies/marketing for Seychelles surfaced.
The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).
No children/vulnerable-groups-specific sub-regime evidenced; recorded as an explicit gap.
Traffic-light rationale — Not assessedNo children/vulnerable-groups-specific sub-regime evidenced; recorded as an explicit gap.
Sub-modules (5)
Age VerificationRed
No age-verification requirement was located.
Parental ConsentRed
No parental-consent mechanism or age-of-digital-consent provision was located.
Minor Profiling BansRed
No minor-profiling prohibition was located.
Education SettingsRed
No education-settings-specific rule was located.
Dependent AdultsRed
No dependent-adults protection provision was located.
Category narrative37 words
No age-of-digital-consent provision, parental-consent mechanism, minor-profiling ban, education-settings rule, or dependent-adults protection specific to the Seychelles Act was identified in this research pass. Searched: general Seychelles Data Protection Act overview and enforcement searches; no child/minor-specific provision surfaced.
Core enforcement power and a compensation right are confirmed; fine quantum, procedure, collective redress, funding/capacity and enforcement-activity record remain unverified gaps.
Supervisory authorityInformation Commission of Seychelles
Traffic-light rationale — AmberCore enforcement power and a compensation right are confirmed; fine quantum, procedure, collective redress, funding/capacity and enforcement-activity record remain unverified gaps.
D10 · Enforcement & Redress — Full Module Record6 sub-modules · 69 words · 4 traced claims · Re-verified 2026-10-25
The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).
Filters combine as OR inside a group and AND across
groups.
Provenance and declared absence
Disclosure model: category cards load OPEN; narratives render in full; standing narratives load as a clamped teaser with an explicit “read full” control carrying the true word count. No text is hidden without disclosing how much of it there is.
Sub-modules are DP-specific nested subsections with their own real per-sub-module traffic light, rendered under each category across all regulatory modules.
Traffic-light dots are REAL data (baseline.<category>.traffic_light), not renderer-invented taxonomy, and are never suppressed -- unlike WPM, where a RAG dot would be forbidden as invented severity.
Family/accent taxonomy is renderer-level presentation config, not a JID field; it decorates the RAG dot, it does not replace it. Colour is always duplicated in text and is never the sole carrier of meaning.
Suppressed by doctrine: derived risk score. Not shown on this page.
Band honesty: uncertainty bands are computed against a frozen build clock of 2026-11-04. A year-precision row is never promoted into a tighter band.
Envelope: baseline resolved at jurisdiction_json.baseline; 10 categories, 58 sub-module(s), 27 claim(s) (27 category placement(s)), 9 source(s) in the cumulative register.
Audit trail
Machine checkChallenged on 6 Oct 2026: nothing tested (no claim on this page was eligible for an automated test). An automated, adversarial test run by a second model; no person has assessed the result.
SC