Not publishable as-is. 2 of 6 publication_gate checks fail. The renderer displays the gate rather than suppressing it. Legal review and sub-brief approval are informational and are not part of this test.
Based mainly on secondary sources. Only 2 of the sources retrieved for this jurisdiction are official or direct reporting of official material (tier 1 or 2), against the 3 we look for. No finding on this page is shown with confidence above “Uncertain” until stronger sources are retrieved.
SC
SCschema gdpri-v2trajectory: not yet assessedregulated (omnibus)
The commencement status of the Data Protection Act, 2023 (Act 24 of 2023) in Seychelles is genuinely disputed between two sources of differing authority.
Data collected · Data published
AI-assembled from cited sources
Not covered: Sectoral Watch, AdTech & Commercial Privacy, Algorithmic, Biometric & Surveillance Governance, Children & Vulnerable Groups. Not fully checked this cycle: Regulator & Framework, Data Subject Rights, Enforcement & Redress (4 open gaps).
10 categories · 16
claims · 7 sources in the cumulative register
10Categoriesbaseline.[]
58Sub-modulesbaseline..sub_modules{}
16Claimsbaseline..claims[]
0Tier-1 sourcesrun_metadata.t1_source_count
Traffic-light mix(sums to 10 rendered categories; click to filter)
No red categories; 45 sub-modules are flagged red.
Jurisdiction lead brief
Standing brief, as of 18 October 2026.
Lead Signal
The commencement status of the Data Protection Act, 2023 (Act 24 of 2023) in Seychelles is genuinely disputed between two sources of differing authority. The Information Commission of Seychelles' own current site states that the Act came into effect following its passage in December 2023, which, as the designated independent supervisory authority responsible for overseeing implementation and enforcement of the Act, would ordinarily be treated as authoritative. A secondary legal directory, however, states that the Act has not been brought into force yet, with data protection in the interim said to continue being governed by Civil Code privacy principles and sectoral statutes. These two accounts cannot both be correct, and no primary Gazette commencement notice has been retrieved to resolve the question. The practical consequence of this dispute is significant: whether Seychelles currently has a functioning, enforceable statutory data protection regime, or whether it remains in a pre-commencement period governed by general civil-law privacy principles, bears directly on every other module of the Act's substantive content.
Other Developments
The Information Commission is confirmed as the designated regulator regardless of the commencement dispute. The Information Commission, headed by the Information Commissioner assisted by two Commissioners, is designated as the independent supervisory authority responsible for overseeing implementation and enforcement of the Data Protection Act, 2023. This institutional designation is not itself disputed; the disagreement is confined to whether the Act the Commission is designated to enforce has actually entered into force.
Cross-Monitor Connections
The disputed commencement status of Seychelles' data protection regime has a bearing on how financial-integrity assessments of the jurisdiction's compliance infrastructure are read, to the extent data-handling and cross-border-transfer obligations intersect with beneficial-ownership and customer-due-diligence data flows; readers tracking that intersection should consult the financial-integrity monitor directly rather than treating this brief as resolving it.
Outlook
Resolution of the commencement dispute depends on retrieval of a primary Gazette commencement notice, which has not yet been located. Until such a notice is identified, the regulator's own assertion of current effect and a contrary secondary-source assertion both remain live and unreconciled; any operational reliance on the Act's current applicability should be treated with that unresolved dispute in mind.
10 of 10 categories
Signal
Density
Selections OR within a group, AND across groups. Press / to search.
Core instrument, regulator identity, commencement date and headline scope are confirmed from a reputable compliance-commentary source, but pinpoint statutory provisions for territorial scope and registration/filing duties are unverified.
Supervisory authorityInformation Commission of Seychelles
Traffic-light rationale — GreenCore instrument, regulator identity, commencement date and headline scope are confirmed from a reputable compliance-commentary source, but pinpoint statutory provisions for territorial scope and registration/filing duties are unverified.
Sub-modules (5)
Regulator And AuthorityGreen
The Information Commission of Seychelles is the Act's designated competent authority with enforcement and fining powers.
Claims (1):
The Information Commission of Seychelles is the competent authority under the Data Protection Act, 2023, with power to enforce and implement the Act and to impose fines on controllers/processors.
Act And InstrumentsGreen
The Data Protection Act, 2023 was gazetted and commenced 22 December 2023, replacing the 2003 Act, with an 18-month transitional period for compliance.
Claims (2):
The Data Protection Act, 2023 was published in the Official Gazette of Seychelles on 22 December 2023 and entered into force the same day, repealing and replacing the Data Protection Act, 2003.
The Act afforded data controllers and processors an 18-month transitional period from the 22 December 2023 commencement date to bring processing activities into conformity, a window that has now elapsed.
Material ScopeGreen
The Act binds public and private sector controllers/processors, subject to criminal-investigation, national-security and personal/household exemptions.
Claims (2):
The Act applies to the processing of personal data by both public- and private-sector controllers and processors in Seychelles.
The Act exempts from its scope the processing of personal data by authorities in the course of a criminal investigation, matters of national security, and processing by a natural person for a purely personal activity.
Territorial ScopeRed
No pinpoint provision on extraterritorial/targeting-and-monitoring application or household/law-enforcement exclusion drafting could be located. Searched: 'Seychelles Data Protection Act 2023 territorial scope', 'seylii.org Data Protection Act 2023 Seychelles'. Absent field provenance: primary Act text not reachable via available search/allowlist.
Regulator Registration And FilingRed
No registration, notification, or fee-duty provision for controllers was located in available sources. Searched: 'Seychelles Information Commission website data protection commissioner office', 'Seychelles Data Protection Act 2023 full text sections'. Absent field provenance: no primary or secondary source surfaced a registration/fee regime for Seychelles.
Category narrative138 words
Seychelles' comprehensive data-protection framework is the Data Protection Act, 2023, which repealed and replaced the Data Protection Act, 2003. The Act was gazetted and entered into force on 22 December 2023, with an 18-month transitional compliance period for controllers/processors that has since elapsed (around 22 June 2025), meaning the regime is now fully operative. The Information Commission of Seychelles is designated as the competent regulator, empowered to enforce and implement the Act, including imposing fines. The Act applies to both public and private sector processing, carved out from criminal-investigation, national-security, and purely personal/household processing. Pinpoint section numbers for material/territorial scope tests (establishment, targeting/monitoring limbs), the representative-appointment duty, and registration/filing/fee obligations could not be located from the available secondary commentary; no primary-source access (official gazette, seylii.org, or a verified Information Commission website) was reachable via search in this pass.
Sources and claims (5)
UncertainOneTrust DataGuidance — The Information Commission of Seychelles is the competent authority under the Data Protection Act, 2023, with power to enforce and implement the Act and to impose fines on controllers/processors.observed
UncertainOneTrust DataGuidance — The Data Protection Act, 2023 was published in the Official Gazette of Seychelles on 22 December 2023 and entered into force the same day, repealing and replacing the Data Protection Act, 2003.observed
UncertainOneTrust DataGuidance — The Act afforded data controllers and processors an 18-month transitional period from the 22 December 2023 commencement date to bring processing activities into conformity, a window that has now elapsed.observed
UncertainOneTrust DataGuidance — The Act applies to the processing of personal data by both public- and private-sector controllers and processors in Seychelles.observed
UncertainOneTrust DataGuidance — The Act exempts from its scope the processing of personal data by authorities in the course of a criminal investigation, matters of national security, and processing by a natural person for a purely personal activity.observed
Existence of a lawful-basis/principles framework is confirmed at headline level only; no pinpoint provisions for consent, special categories, or pseudonymisation were recoverable.
Supervisory authorityInformation Commission of Seychelles
Traffic-light rationale — AmberExistence of a lawful-basis/principles framework is confirmed at headline level only; no pinpoint provisions for consent, special categories, or pseudonymisation were recoverable.
Sub-modules (4)
Lawful BasesAmber
The Act lays down legal bases and principles for processing personal data, though the specific enumerated list/article has not been located.
Claims (1):
The Data Protection Act, 2023 lays down lawful bases for processing and core processing principles applicable to controllers and processors in Seychelles.
Consent ThresholdsRed
No specific consent-validity conditions (freely given, specific, informed, unambiguous; withdrawal mechanics) were located for the Seychelles Act. Absent field provenance: searched DataGuidance overview and general web search; no pinpoint text surfaced.
Special CategoriesRed
No enumerated special/sensitive category list or criminal-offence-data condition was located for the Act. Absent field provenance: searched 'Seychelles Data Protection Act 2023 ... special categories sensitive data'; no pinpoint text surfaced.
Pseudonymisation And AnonymisationRed
No identifiability test, pseudonymisation or anonymisation definition was located for the Act. Absent field provenance: no dedicated source found addressing this sub-module for Seychelles.
Category narrative73 words
The Act lays down lawful bases and processing principles analogous to a GDPR-style regime, but the enumerated list of lawful bases, the consent-validity conditions, any national conditions for special-category/criminal-offence data, and the identifiability test for pseudonymisation/anonymisation could not be pinpointed to specific sections from the sources reachable in this pass. Searched: 'Seychelles Data Protection Act 2023 full text sections', 'Seychelles Data Protection Act 2023 DPO threshold special categories sensitive data law firm summary'.
Sources and claims (1)
UncertainOneTrust DataGuidance — The Data Protection Act, 2023 lays down lawful bases for processing and core processing principles applicable to controllers and processors in Seychelles.observed
Supervisory authorityInformation Commission of Seychelles
Traffic-light rationale — AmberHeadline catalogue of rights is confirmed; procedural detail (deadlines, extension mechanics, minors' independent exercise age) is unverified.
Sub-modules (5)
Access RightAmber
The Act provides data subjects a right to be informed and a right of access to their personal data.
Claims (1):
Data subjects under the Act have the right to be informed of processing and a right of access to their personal data held by a controller.
Rectification And ErasureAmber
The Act provides rights to rectification and deletion of personal data.
Claims (1):
Data subjects under the Act have rights to rectification and deletion (erasure) of their personal data.
Restriction And ObjectionAmber
The Act provides a right to object to the processing of personal data; the compelling-legitimate-grounds test and absolute marketing-objection right are not pinpointed.
Claims (1):
Data subjects under the Act have the right to object to the processing of their personal data.
Data PortabilityAmber
The Act provides a right to data portability.
Claims (1):
Data subjects under the Act have a right to data portability of their personal data.
Deadlines And Response WindowsRed
No statutory response deadline, extension test/length, or fee/manifestly-unfounded test was located. Searched: 'Seychelles Data Protection Act 2023 full text sections breach notification penalties' (also covering response-window content); no pinpoint surfaced. Absent field provenance noted.
Category narrative48 words
The Act grants data subjects the right to be informed, access, rectification, deletion (erasure), objection to processing, data portability, and compensation. Statutory response deadlines, extension tests, the manifestly-unfounded-or-excessive fee test, and the age at which a minor may exercise rights independently could not be located from reachable sources.
Sources and claims (4)
UncertainOneTrust DataGuidance — Data subjects under the Act have the right to be informed of processing and a right of access to their personal data held by a controller.observed
UncertainOneTrust DataGuidance — Data subjects under the Act have rights to rectification and deletion (erasure) of their personal data.observed
UncertainOneTrust DataGuidance — Data subjects under the Act have the right to object to the processing of their personal data.observed
UncertainOneTrust DataGuidance — Data subjects under the Act have a right to data portability of their personal data.observed
DPIA and DPO obligations are confirmed in principle; thresholds, ROPA exemptions, and the breach-notification regime (risk threshold, deadline, content) are unverified gaps.
Supervisory authorityInformation Commission of Seychelles
Traffic-light rationale — AmberDPIA and DPO obligations are confirmed in principle; thresholds, ROPA exemptions, and the breach-notification regime (risk threshold, deadline, content) are unverified gaps.
Sub-modules (7)
Accountability And DpiaAmber
Controllers must perform a DPIA where processing is likely to result in high risk to the rights and freedoms of individuals.
Claims (1):
Controllers under the Act must carry out a Data Protection Impact Assessment where processing is likely to result in a high risk to the rights and freedoms of individuals.
Dpo RequirementsAmber
Controllers must, under certain circumstances, designate a DPO; the specific headcount/activity threshold could not be located.
Claims (1):
Controllers under the Act must, under certain circumstances, designate a Data Protection Officer.
Ropa RequirementsRed
No ROPA exemption test (headcount/risk limbs) located. Absent field provenance: searched general Act overviews; no pinpoint surfaced.
Joint Controller ArrangementsRed
No joint-controller provision or processor-contract mandatory-terms equivalent to Art 28(3) located. Absent field provenance noted.
Security MeasuresRed
No technical/organisational security-of-processing provision pinpointed. Absent field provenance noted.
Breach NotificationRed
No breach-notification risk threshold, regulator/individual deadlines, or content/documentation duty located for the Seychelles Act. Searched: 'Seychelles Data Protection Act 2023 full text sections breach notification penalties'. Absent field provenance: no pinpoint text surfaced in reachable sources; primary Act text not accessible via available search/allowlist.
Retention And DisposalRed
No retention-limit or disposal-duty provision located. Absent field provenance noted.
Category narrative53 words
Controllers must carry out a Data Protection Impact Assessment where processing is likely to result in high risk to individuals' rights and freedoms, and must, under certain (unspecified) circumstances, designate a Data Protection Officer. Records-of-processing exemption tests, joint-controller rules, security-of-processing measures, breach-notification thresholds/timelines, and retention/disposal duties could not be pinpointed from reachable sources.
Sources and claims (2)
UncertainOneTrust DataGuidance — Controllers under the Act must carry out a Data Protection Impact Assessment where processing is likely to result in a high risk to the rights and freedoms of individuals.observed
UncertainOneTrust DataGuidance — Controllers under the Act must, under certain circumstances, designate a Data Protection Officer.observed
The statutory transfer-restriction power is confirmed; adequacy status, SCC/BCR equivalents, TIA requirements, and data-localisation provisions remain unverified gaps.
Supervisory authorityInformation Commission of Seychelles
Traffic-light rationale — AmberThe statutory transfer-restriction power is confirmed; adequacy status, SCC/BCR equivalents, TIA requirements, and data-localisation provisions remain unverified gaps.
Sub-modules (6)
Transfer MechanismsAmber
The Act restricts cross-border transfers and empowers the Commission to make implementing regulations on transfer circumstances/restrictions; a separate sectoral EU-Seychelles fisheries agreement contains its own Art 13 data-protection clause for a narrow fisheries-monitoring data flow.
Claims (2):
The Data Protection Act, 2023 specifies rules restricting cross-border transfer of personal data and empowers the Information Commission to introduce regulations governing the circumstances and restrictions of such transfers.
The EU-Seychelles Sustainable Fisheries Partnership Agreement contains a bespoke Article 13 data-protection clause for personal data exchanged for fisheries monitoring, control and surveillance purposes, which the EDPS recommended the EU-Seychelles Joint Committee further detail (retention period, anonymisation obligation, enforceable remedies) to ensure GDPR/EUDPR-equivalent safeguards.
Adequacy ReceivedRed
No evidence located that Seychelles has received an adequacy decision from another regime. Absent field provenance noted.
Adequacy GrantedRed
No EU (or other) adequacy decision covering Seychelles under GDPR Art 45 was identified in this search pass. Absent field provenance: general web search; no adequacy-decision text for Seychelles surfaced.
Sccs And BcrsRed
No SCC or BCR-equivalent instrument for the Seychelles regime was located. Absent field provenance noted.
Transfer Impact AssessmentRed
No statutory or regulator-guidance TIA requirement was located. Absent field provenance noted.
Data LocalisationRed
No data-localisation mandate was located for Seychelles. Absent field provenance noted.
Category narrative92 words
The Act specifies rules for cross-border transfer of personal data and empowers the Information Commission to make regulations on the circumstances and restrictions of such transfers; the detailed transfer-mechanism hierarchy (adequacy-equivalent findings, SCC/BCR-type instruments, derogations) has not yet been located, consistent with the Commission's regulation-making power not yet being confirmed as exercised. Separately, a sector-specific EU-Seychelles fisheries agreement contains its own Article 13 data-protection clause for data shared for fisheries monitoring, on which the EDPS recommended further safeguards be developed. No EU adequacy decision for Seychelles under GDPR Art 45 was identified.
Sources and claims (2)
UncertainOneTrust DataGuidance — The Data Protection Act, 2023 specifies rules restricting cross-border transfer of personal data and empowers the Information Commission to introduce regulations governing the circumstances and restrictions of such transfers.observed
UncertainOfficial Journal of the European Union — The EU-Seychelles Sustainable Fisheries Partnership Agreement contains a bespoke Article 13 data-protection clause for personal data exchanged for fisheries monitoring, control and surveillance purposes, which the EDPS recommended the EU-Seychelles Joint Committee further detail (retention period, anonymisation obligation, enforceable remedies) to ensure GDPR/EUDPR-equivalent safeguards.observed
No sectoral overlay or data-access/sharing scheme could be evidenced from reachable sources; this is recorded as an explicit gap rather than a silent omission.
Traffic-light rationale — Not assessedNo sectoral overlay or data-access/sharing scheme could be evidenced from reachable sources; this is recorded as an explicit gap rather than a silent omission.
Sub-modules (8)
Financial Sector OverlayRed
No Seychelles banking-secrecy or open-banking data-access overlay to the general DP regime was located.
Health Sector OverlayRed
No health-sector-specific data rule was located.
Telecoms And EprivacyRed
No national ePrivacy-equivalent transposition for communications traffic/location data was located.
Employment DataRed
No employment-context data provision was located.
Credit And ScoringRed
No credit-scoring-specific rule was located.
EducationRed
No education-sector-specific rule was located.
InsuranceRed
No insurance-sector-specific rule was located.
Data Access SharingRed
No local data-access, smart-data, or data-portability scheme analogous to the EU Data Act was located for Seychelles.
Category narrative88 words
No sector-specific data-protection overlays (financial/banking-secrecy, health, telecoms/eProvacy traffic-data retention, employment-specific, credit-scoring, education, insurance) or a horizontal data-access/data-sharing scheme analogous to the EU Data Act were identified for Seychelles in this research pass. Searched: 'Seychelles Information Commission ICT data protection commissioner appointed', 'seychellesnewsagency Data Protection Act Information Commission 2023 2024', general Seychelles Data Protection Act overview searches. As a non-EU jurisdiction, the EU Data Act (Regulation (EU) 2023/2854) does not itself bind Seychelles domestic controllers absent an EU-market-facing nexus, and no such nexus or local equivalent scheme was found.
No adtech-specific sub-regime evidenced; recorded as an explicit gap.
Traffic-light rationale — Not assessedNo adtech-specific sub-regime evidenced; recorded as an explicit gap.
Sub-modules (6)
Cookies And TrackersRed
No pinpoint cookie/tracker consent provision was located for Seychelles.
Dark PatternsRed
No dark-pattern prohibition was located.
Opt Out SignalsRed
No opt-out-signal (e.g., GPC-equivalent) regime was located.
Clean Rooms And DcrRed
No clean-room/data-collaboration rule was located.
Cross Context AdvertisingRed
No cross-context-advertising-specific rule was located.
Direct MarketingRed
No direct-marketing consent/suppression rule specific to Seychelles was located, beyond the Act's general objection right noted under data_subject_rights.
Category narrative39 words
No cookie/tracker-specific provision, dark-pattern prohibition, opt-out-signal regime, clean-room rule, or direct-marketing consent/suppression rule specific to Seychelles was identified. Searched: general Seychelles Data Protection Act overview and enforcement searches; no ePrivacy-style instrument or regulator guidance on cookies/marketing for Seychelles surfaced.
No algorithmic/biometric/surveillance-specific sub-regime evidenced; recorded as an explicit gap.
Traffic-light rationale — Not assessedNo algorithmic/biometric/surveillance-specific sub-regime evidenced; recorded as an explicit gap.
Sub-modules (6)
Profiling RestrictionsRed
No profiling-restriction provision was located.
Automated Decision Making TransparencyRed
No ADM transparency/explanation-right provision was located.
Ai Risk AssessmentsRed
No AI-specific risk-assessment regime or designated AI authority was located.
Biometric RegimeRed
No biometric-data processing condition was located.
Genetic DataRed
No genetic-data-specific regime was located.
State Surveillance CarveoutsRed
Beyond the Act's general national-security exemption noted under regulator_and_framework.material_scope, no further detail on the limits of that carve-out was located.
Category narrative40 words
No Article-22-style automated-decision-making provision, AI-specific risk-assessment regime, biometric-processing condition, genetic-data rule, or state-surveillance carve-out specific to Seychelles was identified in this research pass. Searched: general Seychelles Data Protection Act overview searches; no dedicated AI/biometric instrument or Information Commission guidance surfaced.
No children/vulnerable-groups-specific sub-regime evidenced; recorded as an explicit gap.
Traffic-light rationale — Not assessedNo children/vulnerable-groups-specific sub-regime evidenced; recorded as an explicit gap.
Sub-modules (5)
Age VerificationRed
No age-verification requirement was located.
Parental ConsentRed
No parental-consent mechanism or age-of-digital-consent provision was located.
Minor Profiling BansRed
No minor-profiling prohibition was located.
Education SettingsRed
No education-settings-specific rule was located.
Dependent AdultsRed
No dependent-adults protection provision was located.
Category narrative37 words
No age-of-digital-consent provision, parental-consent mechanism, minor-profiling ban, education-settings rule, or dependent-adults protection specific to the Seychelles Act was identified in this research pass. Searched: general Seychelles Data Protection Act overview and enforcement searches; no child/minor-specific provision surfaced.
Core enforcement power and a compensation right are confirmed; fine quantum, procedure, collective redress, funding/capacity and enforcement-activity record remain unverified gaps.
Supervisory authorityInformation Commission of Seychelles
Traffic-light rationale — AmberCore enforcement power and a compensation right are confirmed; fine quantum, procedure, collective redress, funding/capacity and enforcement-activity record remain unverified gaps.
Sub-modules (6)
Regulator Powers And PenaltiesAmber
The Commission may enforce and implement the Act and impose fines; specific fine tiers/amounts were not located.
Claims (1):
The Information Commission of Seychelles has the power under the Data Protection Act, 2023 to enforce and implement the Act, including imposing fines on controllers and processors for non-compliance.
Enforcement Activity IndexRed
No enforcement decisions or fines imposed under the Act were located in the last 12 months. Absent field provenance: searched 'Seychelles Information Commission data protection enforcement fine'; no decisions surfaced.
Regulator Funding And CapacityRed
No funding or headcount information for the Information Commission of Seychelles was located.
Collective Redress And Class ActionsRed
No representative/collective-action mechanism analogous to GDPR Art 80 was located.
Private Right Of ActionAmber
The Act provides data subjects a right to compensation; whether this is exercised via direct court action, complaint to the Commission, or both, was not located.
Claims (1):
The Data Protection Act, 2023 provides data subjects with a right to compensation for contraventions of the Act.
Recent Developments 180DRed
No Seychelles data-protection legal/regulatory development within the last 180 days (i.e., since approximately April 2026) was identified. Searched: 'seychellesnewsagency Data Protection Act Information Commission 2023 2024'.
Category narrative69 words
The Information Commission has the power to enforce and implement the Act, including imposing fines, and the Act provides data subjects a right to compensation. Maximum fine tiers/turnover percentages, procedural investigation/appeal deadlines, collective-redress/representative-action mechanisms, limitation periods, regulator funding/headcount signals, and any enforcement decisions in the last 12 months could not be located from reachable sources. No developments specific to Seychelles data protection within the last 180 days were identified.
Sources and claims (2)
UncertainOneTrust DataGuidance — The Information Commission of Seychelles has the power under the Data Protection Act, 2023 to enforce and implement the Act, including imposing fines on controllers and processors for non-compliance.observed
UncertainOneTrust DataGuidance — The Data Protection Act, 2023 provides data subjects with a right to compensation for contraventions of the Act.observed
No categories match.
Filters combine as OR inside a group and AND across
groups.
Publication gate
Blocking. 2 failing check(s).
schema_valid
pass
min_quoted_text_present
waived — floor 0%
translation_provenance_recorded
n/a — no subject in this jurisdiction
egress_verified
pass
min_t1_per_instrument_met
n/a — no subject in this jurisdiction
jurisdiction_source_floor_met
FAIL
source_tier_integrity_ok
pass
manual_override
FAIL
tier_a_b_national_primary_pct
50.0
aggregator_only_jurisdiction_count
0
Editorial metadata
Provenance only. Nothing below gates publication or affects the render.
Editorial metadata for SC
Field
Value
trust.lawyer_review.status
never_reviewed
trust.lawyer_review.reviewer
no reviewer on record
trust.content_source
ai_generated
Provenance and declared absence
Disclosure model: category cards load OPEN; narratives render in full; standing narratives load as a clamped teaser with an explicit “read full” control carrying the true word count. No text is hidden without disclosing how much of it there is.
Sub-modules are DP-specific nested subsections with their own real per-sub-module traffic light, rendered under each category (BRIEF section 2b.5). Neither WPM nor the crypto monitor carries this field.
Traffic-light dots are REAL data (baseline.<category>.traffic_light), not renderer-invented taxonomy, and are never suppressed -- unlike WPM, where a RAG dot would be forbidden as invented severity.
Family/accent taxonomy is renderer-level presentation config, not a JID field; it decorates the RAG dot, it does not replace it. Colour is always duplicated in text and is never the sole carrier of meaning.
Suppressed by doctrine: derived risk score; derived_scores = {}.
Band honesty: uncertainty bands are computed against a frozen build clock of 2026-10-20. A year-precision row is never promoted into a tighter band.
Envelope: baseline resolved at jurisdiction_json.baseline; 10 categories, 58 sub-module(s), 16 claim(s) (16 category placement(s)), 7 source(s) in the cumulative register.
Audit trail
Machine checkChallenged on 6 Oct 2026: nothing tested (no claim on this page was eligible for an automated test). An automated, adversarial test run by a second model; no person has assessed the result.
regulator_and_framework, data_subject_rights, controller_processor_duties, cross_border_and_adequacy, and enforcement_and_redress carry headline-level findings sourced from a single T3 compliance-commentary source (DataGuidance) plus one T2 EU official-journal source (EDPS opinion on the EU-Seychelles fisheries agreement) for a narrow sectoral transfer clause; no T1 primary-instrument source (official gazette text, seylii.org, or a verified Information Commission website) was reachable via available search in this pass. lawful_processing_and_special_data is populated only at the lawful-bases headline level, with consent, special-categories and pseudonymisation sub-modules carrying no findings. sectoral_watch, adtech_and_commercial_privacy, algorithmic_biometric_and_surveillance_governance, and children_and_vulnerable_groups carry no findings at all for Seychelles and are recorded as explicit gaps rather than silent omissions.
Unresolved questions (10):
What is the pinpoint section/article structure of the Data Protection Act, 2023 (lawful bases, consent conditions, special-category conditions, pseudonymisation test)?
What is the specific DPO-appointment threshold (headcount/activity test) under the Act?
What is the breach-notification risk threshold, regulator/individual deadline, and required content under the Act?
Has the Information Commission exercised its Art/section power to make cross-border-transfer regulations, and if so what mechanisms (adequacy-type list, SCC/BCR equivalents, derogations) do they establish?
Has Seychelles signed or ratified the African Union Malabo Convention on Cyber Security and Personal Data Protection? (Not confirmed in this pass.)
What are the maximum fine tiers/amounts and fine-calculation methodology under the Act?
Has the Information Commission of Seychelles issued any enforcement decisions, and what is its funding/headcount capacity?
Does any sector-specific overlay (financial, health, telecoms/eprivacy, employment, credit, education, insurance) or data-access-sharing scheme exist in Seychelles law?
Does the Act contain any AI/ADM-specific, biometric, genetic-data, or children/minors-specific provisions?
What is the official URL of the Information Commission of Seychelles and has a Data Protection/Information Commissioner been appointed?