--- title: "SC Data Protection & Privacy Regulation | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/sc-data-protection-privacy-regulation/ source_html: /jurisdictions/seychelles/index.html description: "SC data protection and privacy regulation: 10 categories, 27 claims, updated 2026-10-25. Lawful processing, data subject rights, cross-border transfer…" generated_at: 2026-11-07T14:58:19Z content_sha256: e1a602326fd7737460b214ccfa92763ec326b1e8e8758db9eb2812c2dab0dfd8 generator: "fe-fleet/md-twin@1.0" --- # SC Data Protection & Privacy Regulation | Data Protection Monitor Based mainly on secondary sources. Only 2 of the sources retrieved for this jurisdiction are official or direct reporting of official material (tier 1 or 2), against the 3 we look for. No finding on this page is shown with confidence above “Uncertain” until stronger sources are retrieved. # SC Data Protection & Privacy Regulation schema gdpri-v2 trajectory: not yet assessed regulated (omnibus) Last updated 2026-10-25 · 10 categories · 27 claims · 9 sources in the cumulative register Download report (PDF) Expand all The commencement status of the Data Protection Act, 2023 (Act 24 of 2023) in Seychelles is genuinely disputed between two sources of differing authority. Data collected 2026-10-25 · Data published 2026-10-25 AI-assembled from cited sources Not covered: Sectoral Watch, AdTech & Commercial Privacy, Algorithmic, Biometric & Surveillance Governance, Children & Vulnerable Groups. Not fully checked this cycle: Controller/Processor Duties, Enforcement & Redress (4 open gaps). Evidence re-verified: 2026-10-25 · Position last changed: 2026-10-25 · Record history & provenance ▾ Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently. Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26 [Open in Co-Pilot ↗](/reports/?type=copilot&j=SEYCHELLES)[Build Report](/reports/?j=SEYCHELLES)[Compare](/compare/?j=SEYCHELLES) Framework posture Regulated (omnibus) 7 of 10 modules populated · AI-synthesised · Tier-1/2 verified Lead supervisory authority Information Commission of Seychelles Primary statutory & supervisory perimeter Next milestone (> 2026-10-26) None scheduled No dated future statutory milestone on record Module coverage & confidence 7 / 10 modules assessed 0 Confirmed · 6 Probable · 1 Uncertain · 3 Not yet assessed 10 Categories 1 Red categories 58 Sub-modules 27 Claims 0 Tier-1 sources Traffic-light mix 1 green 5 amber 3 n/a 1 red (sums to 10 rendered categories; click to filter) 1 category flagged red ## Jurisdiction lead brief Standing brief, as of 18 October 2026. #### Lead Signal The commencement status of the Data Protection Act, 2023 (Act 24 of 2023) in Seychelles is genuinely disputed between two sources of differing authority. The Information Commission of Seychelles' own current site states that the Act came into effect following its passage in December 2023, which, as the designated independent supervisory authority responsible for overseeing implementation and enforcement of the Act, would ordinarily be treated as authoritative. A secondary legal directory, however, states that the Act has not been brought into force yet, with data protection in the interim said to continue being governed by Civil Code privacy principles and sectoral statutes. These two accounts cannot both be correct, and no primary Gazette commencement notice has been retrieved to resolve the question. The practical consequence of this dispute is significant: whether Seychelles currently has a functioning, enforceable statutory data protection regime, or whether it remains in a pre-commencement period governed by general civil-law privacy principles, bears directly on every other module of the Act's substantive content. #### Other Developments The Information Commission is confirmed as the designated regulator regardless of the commencement dispute. The Information Commission, headed by the Information Commissioner assisted by two Commissioners, is designated as the independent supervisory authority responsible for overseeing implementation and enforcement of the Data Protection Act, 2023. This institutional designation is not itself disputed; the disagreement is confined to whether the Act the Commission is designated to enforce has actually entered into force. #### Cross-Monitor Connections The disputed commencement status of Seychelles' data protection regime has a bearing on how financial-integrity assessments of the jurisdiction's compliance infrastructure are read, to the extent data-handling and cross-border-transfer obligations intersect with beneficial-ownership and customer-due-diligence data flows; readers tracking that intersection should consult the financial-integrity monitor directly rather than treating this brief as resolving it. #### Outlook Resolution of the commencement dispute depends on retrieval of a primary Gazette commencement notice, which has not yet been located. Until such a notice is identified, the regulator's own assertion of current effect and a contrary secondary-source assertion both remain live and unreconciled; any operational reliance on the Act's current applicability should be treated with that unresolved dispute in mind. Read full brief · 366 words Key regulatory facts for SC Regulatory Dimension SC Standing Position Jurisdiction SC (SC) Regulatory Scope Data Protection & Privacy Regulation (10 modules, 27 sourced findings) Regulator & Framework Core instrument, regulator identity, commencement date and headline scope are confirmed from a reputable compliance-commentary source, but pinpoint statutory provisions for territorial scope and registration/filing... Lawful Processing & Special Data Existence of a lawful-basis/principles framework is confirmed at headline level only; no pinpoint provisions for consent, special categories, or pseudonymisation were recoverable. Data Subject Rights Headline catalogue of rights is confirmed; procedural detail (deadlines, extension mechanics, minors' independent exercise age) is unverified. Controller/Processor Duties DPIA and DPO obligations are confirmed in principle; thresholds, ROPA exemptions, and the breach-notification regime (risk threshold, deadline, content) are unverified gaps. Primary Instruments Cited OneTrust DataGuidance, SC Official Instrument (dlapiperdataprotection.com index-html-t-law-c-SC), DLA Piper, Official Journal of the European Union, TechHive Advisory Last Confirmed / Updated 2026-10-25 (9 sources in cumulative register) 10 of 10 categories Signal Red Amber Green Density Comfortable Compact Expand all sources Reset all Selections OR within a group, AND across groups. Press / to search. ### SC: D1 Regulator & Framework5 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Core instrument, regulator identity, commencement date and headline scope are confirmed from a reputable compliance-commentary source, but pinpoint statutory provisions for territorial scope and registration/filing duties are unverified. Primary framework Data Protection Act, 2023 (Seychelles) Supervisory authority Information Commission of Seychelles Traffic-light rationale — Green Core instrument, regulator identity, commencement date and headline scope are confirmed from a reputable compliance-commentary source, but pinpoint statutory provisions for territorial scope and registration/filing duties are unverified. #### Sub-modules (5) #### Regulator And AuthorityGreen The Information Commission of Seychelles is the Act's designated competent authority with enforcement and fining powers. Claims (2): - The Information Commission of Seychelles is the competent authority under the Data Protection Act, 2023, with power to enforce and implement the Act and to impose fines on controllers/processors. - Information Commission of Seychelles — Headed by an Information Commissioner assisted by two Commissioners, responsible for oversight and enforcement under the Data Protection Act, 2023. #### Act And InstrumentsGreen The Data Protection Act, 2023 was gazetted and commenced 22 December 2023, replacing the 2003 Act, with an 18-month transitional period for compliance. Claims (4): - The Data Protection Act, 2023 was published in the Official Gazette of Seychelles on 22 December 2023 and entered into force the same day, repealing and replacing the Data Protection Act, 2003. - The Act afforded data controllers and processors an 18-month transitional period from the 22 December 2023 commencement date to bring processing activities into conformity, a window that has now elapsed. - Data Protection Act, 2023 (Act 24 of 2023) — Came into force 22 Dec 2023, replacing the Data Protection Act, 2003. - Data Protection Act, 2023 (Act 24 of 2023) — A conflicting secondary source (DLA Piper) states the Act 'has not been brought into force yet', pending which data protection continues to be governed by Civil Code privacy principles and sectoral statutes. #### Material ScopeGreen The Act binds public and private sector controllers/processors, subject to criminal-investigation, national-security and personal/household exemptions. Claims (3): - The Act applies to the processing of personal data by both public- and private-sector controllers and processors in Seychelles. - The Act exempts from its scope the processing of personal data by authorities in the course of a criminal investigation, matters of national security, and processing by a natural person for a purely personal activity. - Data Protection Act, 2023 (Seychelles) s.3 — Applies to processing of personal data through automated or semi-automated means, or where data form part of a filing system, within Seychelles; excludes criminal-investigation, national-security, and purely personal processing. #### Territorial ScopeRed No pinpoint provision on extraterritorial/targeting-and-monitoring application or household/law-enforcement exclusion drafting could be located. Searched: 'Seychelles Data Protection Act 2023 territorial scope', 'seylii.org Data Protection Act 2023 Seychelles'. Absent field provenance: primary Act text not reachable via available search/allowlist. #### Regulator Registration And FilingRed No registration, notification, or fee-duty provision for controllers was located in available sources. Searched: 'Seychelles Information Commission website data protection commissioner office', 'Seychelles Data Protection Act 2023 full text sections'. Absent field provenance: no primary or secondary source surfaced a registration/fee regime for Seychelles. Seychelles' comprehensive data-protection framework is the Data Protection Act, 2023, which repealed and replaced the Data Protection Act, 2003. The Act was gazetted and entered into force on 22 December 2023, with an 18-month transitional compliance period for controllers/processors that has since elapsed (around 22 June 2025), meaning the regime is now fully operative. The Information Commission of Seychelles is designated as the competent regulator, empowered to enforce and implement the Act, including imposing fines. The Act applies to both public and private sector processing, carved out from criminal-investigation, national-security, and purely personal/household processing. Pinpoint section numbers for material/territorial scope tests (establishment, targeting/monitoring limbs), the representative-appointment duty, and registration/filing/fee obligations could not be located from the available secondary commentary; no primary-source access (official gazette, seylii.org, or a verified Information Commission website) was reachable via search in this pass. Sources and claims (9) - [OneTrust DataGuidance](https://www.dataguidance.com/jurisdictions/seychelles) — The Information Commission of Seychelles is the competent authority under the Data Protection Act, 2023, with power to enforce and implement the Act and to impose fines on controllers/processors. - [OneTrust DataGuidance](https://www.dataguidance.com/jurisdictions/seychelles) — The Data Protection Act, 2023 was published in the Official Gazette of Seychelles on 22 December 2023 and entered into force the same day, repealing and replacing the Data Protection Act, 2003. - [OneTrust DataGuidance](https://www.dataguidance.com/jurisdictions/seychelles) — The Act afforded data controllers and processors an 18-month transitional period from the 22 December 2023 commencement date to bring processing activities into conformity, a window that has now elapsed. - [OneTrust DataGuidance](https://www.dataguidance.com/jurisdictions/seychelles) — The Act applies to the processing of personal data by both public- and private-sector controllers and processors in Seychelles. - [OneTrust DataGuidance](https://www.dataguidance.com/jurisdictions/seychelles) — The Act exempts from its scope the processing of personal data by authorities in the course of a criminal investigation, matters of national security, and processing by a natural person for a purely personal activity. - [https://www.dlapiperdataprotection.com/index.html?t=law&c=SC](https://www.dlapiperdataprotection.com/index.html?t=law&c=SC) — Data Protection Act, 2023 (Act 24 of 2023) — Came into force 22 Dec 2023, replacing the Data Protection Act, 2003. - [DLA Piper](https://www.dlapiperdataprotection.com/index.html?t=authority&c=SC) — Data Protection Act, 2023 (Act 24 of 2023) — A conflicting secondary source (DLA Piper) states the Act 'has not been brought into force yet', pending which data protection continues to be governed by Civil Code privacy principles and sectoral statutes. - [OneTrust DataGuidance](https://www.dataguidance.com/jurisdictions/seychelles) — Information Commission of Seychelles — Headed by an Information Commissioner assisted by two Commissioners, responsible for oversight and enforcement under the Data Protection Act, 2023. - Primary statutory record — Data Protection Act, 2023 (Seychelles) s.3 — Applies to processing of personal data through automated or semi-automated means, or where data form part of a filing system, within Seychelles; excludes criminal-investigation, national-security, and purely personal processing. ### SC: D2 Lawful Processing & Special Data4 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Existence of a lawful-basis/principles framework is confirmed at headline level only; no pinpoint provisions for consent, special categories, or pseudonymisation were recoverable. Primary framework Data Protection Act, 2023 (Seychelles) Supervisory authority Information Commission of Seychelles Traffic-light rationale — Amber Existence of a lawful-basis/principles framework is confirmed at headline level only; no pinpoint provisions for consent, special categories, or pseudonymisation were recoverable. D2 · Lawful Processing — Full Module Record 4 sub-modules · 73 words · 1 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login) [Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### SC: D3 Data Subject Rights5 sub-modulesAmberEnacted in forceModule confidence: Uncertain▾ Headline catalogue of rights is confirmed; procedural detail (deadlines, extension mechanics, minors' independent exercise age) is unverified. Primary framework Data Protection Act, 2023 (Seychelles) Supervisory authority Information Commission of Seychelles Traffic-light rationale — Amber Headline catalogue of rights is confirmed; procedural detail (deadlines, extension mechanics, minors' independent exercise age) is unverified. #### Sub-modules (5) #### Access RightAmber The Act provides data subjects a right to be informed and a right of access to their personal data. Claims (1): - Data subjects under the Act have the right to be informed of processing and a right of access to their personal data held by a controller. #### Rectification And ErasureAmber The Act provides rights to rectification and deletion of personal data. Claims (1): - Data subjects under the Act have rights to rectification and deletion (erasure) of their personal data. #### Restriction And ObjectionAmber The Act provides a right to object to the processing of personal data; the compelling-legitimate-grounds test and absolute marketing-objection right are not pinpointed. Claims (1): - Data subjects under the Act have the right to object to the processing of their personal data. #### Data PortabilityAmber The Act provides a right to data portability. Claims (1): - Data subjects under the Act have a right to data portability of their personal data. #### Deadlines And Response WindowsRed No statutory response deadline, extension test/length, or fee/manifestly-unfounded test was located. Searched: 'Seychelles Data Protection Act 2023 full text sections breach notification penalties' (also covering response-window content); no pinpoint surfaced. Absent field provenance noted. The Act grants data subjects the right to be informed, access, rectification, deletion (erasure), objection to processing, data portability, and compensation. Statutory response deadlines, extension tests, the manifestly-unfounded-or-excessive fee test, and the age at which a minor may exercise rights independently could not be located from reachable sources. Sources and claims (4) - [OneTrust DataGuidance](https://www.dataguidance.com/jurisdictions/seychelles) — Data subjects under the Act have the right to be informed of processing and a right of access to their personal data held by a controller. - [OneTrust DataGuidance](https://www.dataguidance.com/jurisdictions/seychelles) — Data subjects under the Act have rights to rectification and deletion (erasure) of their personal data. - [OneTrust DataGuidance](https://www.dataguidance.com/jurisdictions/seychelles) — Data subjects under the Act have the right to object to the processing of their personal data. - [OneTrust DataGuidance](https://www.dataguidance.com/jurisdictions/seychelles) — Data subjects under the Act have a right to data portability of their personal data. ### SC: D4 Controller/Processor Duties7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ DPIA and DPO obligations are confirmed in principle; thresholds, ROPA exemptions, and the breach-notification regime (risk threshold, deadline, content) are unverified gaps. Primary framework Data Protection Act, 2023 (Seychelles) Supervisory authority Information Commission of Seychelles Traffic-light rationale — Amber DPIA and DPO obligations are confirmed in principle; thresholds, ROPA exemptions, and the breach-notification regime (risk threshold, deadline, content) are unverified gaps. D4 · Controller & Processor — Full Module Record 7 sub-modules · 53 words · 4 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### SC: D5 Cross-Border & Adequacy6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ The statutory transfer-restriction power is confirmed; adequacy status, SCC/BCR equivalents, TIA requirements, and data-localisation provisions remain unverified gaps. Primary framework Data Protection Act, 2023 (Seychelles) Supervisory authority Information Commission of Seychelles Traffic-light rationale — Amber The statutory transfer-restriction power is confirmed; adequacy status, SCC/BCR equivalents, TIA requirements, and data-localisation provisions remain unverified gaps. D5 · Cross-Border & Adequacy — Full Module Record 6 sub-modules · 92 words · 3 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### SC: D6 Sectoral Watch 8 sub-modules Not assessed ▾ No sectoral overlay or data-access/sharing scheme could be evidenced from reachable sources; this is recorded as an explicit gap rather than a silent omission. Traffic-light rationale — Not assessed No sectoral overlay or data-access/sharing scheme could be evidenced from reachable sources; this is recorded as an explicit gap rather than a silent omission. #### Sub-modules (8) #### Financial Sector OverlayRed No Seychelles banking-secrecy or open-banking data-access overlay to the general DP regime was located. #### Health Sector OverlayRed No health-sector-specific data rule was located. #### Telecoms And EprivacyRed No national ePrivacy-equivalent transposition for communications traffic/location data was located. #### Employment DataRed No employment-context data provision was located. #### Credit And ScoringRed No credit-scoring-specific rule was located. #### EducationRed No education-sector-specific rule was located. #### InsuranceRed No insurance-sector-specific rule was located. #### Data Access SharingRed No local data-access, smart-data, or data-portability scheme analogous to the EU Data Act was located for Seychelles. No sector-specific data-protection overlays (financial/banking-secrecy, health, telecoms/eProvacy traffic-data retention, employment-specific, credit-scoring, education, insurance) or a horizontal data-access/data-sharing scheme analogous to the EU Data Act were identified for Seychelles in this research pass. Searched: 'Seychelles Information Commission ICT data protection commissioner appointed', 'seychellesnewsagency Data Protection Act Information Commission 2023 2024', general Seychelles Data Protection Act overview searches. As a non-EU jurisdiction, the EU Data Act (Regulation (EU) 2023/2854) does not itself bind Seychelles domestic controllers absent an EU-market-facing nexus, and no such nexus or local equivalent scheme was found. ### SC: D7 AdTech & Commercial Privacy 6 sub-modules Not assessed ▾ No adtech-specific sub-regime evidenced; recorded as an explicit gap. Traffic-light rationale — Not assessed No adtech-specific sub-regime evidenced; recorded as an explicit gap. #### Sub-modules (6) #### Cookies And TrackersRed No pinpoint cookie/tracker consent provision was located for Seychelles. #### Dark PatternsRed No dark-pattern prohibition was located. #### Opt Out SignalsRed No opt-out-signal (e.g., GPC-equivalent) regime was located. #### Clean Rooms And DcrRed No clean-room/data-collaboration rule was located. #### Cross Context AdvertisingRed No cross-context-advertising-specific rule was located. #### Direct MarketingRed No direct-marketing consent/suppression rule specific to Seychelles was located, beyond the Act's general objection right noted under data_subject_rights. No cookie/tracker-specific provision, dark-pattern prohibition, opt-out-signal regime, clean-room rule, or direct-marketing consent/suppression rule specific to Seychelles was identified. Searched: general Seychelles Data Protection Act overview and enforcement searches; no ePrivacy-style instrument or regulator guidance on cookies/marketing for Seychelles surfaced. ### SC: D8 Algorithmic, Biometric & Surveillance Governance6 sub-modulesRedEnacted in forceModule confidence: Probable▾ No algorithmic/biometric/surveillance-specific sub-regime evidenced; recorded as an explicit gap. Traffic-light rationale — Red No algorithmic/biometric/surveillance-specific sub-regime evidenced; recorded as an explicit gap. D8 · AI, Biometrics & Automated — Full Module Record 6 sub-modules · 40 words · 2 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### SC: D9 Children & Vulnerable Groups 5 sub-modules Not assessed ▾ No children/vulnerable-groups-specific sub-regime evidenced; recorded as an explicit gap. Traffic-light rationale — Not assessed No children/vulnerable-groups-specific sub-regime evidenced; recorded as an explicit gap. #### Sub-modules (5) #### Age VerificationRed No age-verification requirement was located. #### Parental ConsentRed No parental-consent mechanism or age-of-digital-consent provision was located. #### Minor Profiling BansRed No minor-profiling prohibition was located. #### Education SettingsRed No education-settings-specific rule was located. #### Dependent AdultsRed No dependent-adults protection provision was located. No age-of-digital-consent provision, parental-consent mechanism, minor-profiling ban, education-settings rule, or dependent-adults protection specific to the Seychelles Act was identified in this research pass. Searched: general Seychelles Data Protection Act overview and enforcement searches; no child/minor-specific provision surfaced. ### SC: D10 Enforcement & Redress6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Core enforcement power and a compensation right are confirmed; fine quantum, procedure, collective redress, funding/capacity and enforcement-activity record remain unverified gaps. Primary framework Data Protection Act, 2023 (Seychelles) Supervisory authority Information Commission of Seychelles Traffic-light rationale — Amber Core enforcement power and a compensation right are confirmed; fine quantum, procedure, collective redress, funding/capacity and enforcement-activity record remain unverified gaps. D10 · Enforcement & Redress — Full Module Record 6 sub-modules · 69 words · 4 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ## GDPR article map Cross-reference: which category/sub-module covers each UK GDPR article (38 mapped). Show article map GDPR article to category mapping Article Category Sub-module Art. 5 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 6 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) lawful bases Art. 7 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) consent thresholds Art. 9 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) special categories Art. 13 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 14 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 15 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 16 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 17 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 18 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 19 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 20 [Data Subject Rights](#sec-cat-data_subject_rights) data portability Art. 21 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 22 [Algorithmic, Biometric & Surveillance Governance](#sec-cat-algorithmic_biometric_and_surveillance_governance) automated decision making transparency Art. 25 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 28 [Controller/Processor Duties](#sec-cat-controller_processor_duties) joint controller arrangements Art. 30 [Controller/Processor Duties](#sec-cat-controller_processor_duties) ropa requirements Art. 32 [Controller/Processor Duties](#sec-cat-controller_processor_duties) security measures Art. 33 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 34 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 35 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 37 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 38 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 39 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 44 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 45 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) adequacy granted Art. 46 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 47 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 48 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 49 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 77 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 78 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 79 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions Art. 80 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions Art. 81 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 82 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 83 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 84 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties