Seychelles

Regulator: Information Commission ↗
Law: Data Protection Act 2023 (Act 24 of 2023; in force 22 Dec 2023, transition ended 22 June 2025) ↗
Status: Law in force, enforcement not found
Authority: Information Commission, established 2019

in force

DP law status

Data Protection Act 2023 (Act 24 of 2023; in force 22 Dec 2023, transition ended 22 June 2025)

None found

enforcement activity

as of the last landscape verification

decisions published

no public record to collect

The law

Data Protection Act, 2023 (Act 24 of 2023) IN FORCE

commenced 2023-12-22 (18-month transition ended 2025-06-22) · Official full text ↗

Scope: Controllers/processors in Seychelles and foreign entities processing personal data of persons in Seychelles.
Key obligations: GDPR-style principles and lawful bases; DPIAs for high-risk processing; Records of processing
DPO required: Required in prescribed cases.
Registration: Notification/registration with the Information Commission.
Cross-border transfers: Adequacy/appropriate safeguards regime.
Breach notification: 72-hour notification to the Information Commission.
Penalties: Enforcement notices and administrative fines; offences carry criminal penalties.
Authority: Information Commission (combined ATI/DP regulator)

Verified 2026-07-06

Access to information

Access to Information Act 2018 IN FORCE

The regulator

Authority: Information Commission
Website: https://www.infocom.sc ↗
Established: 2019
Operational: Yes
Enforcing: No enforcement activity found
Publishes decisions: No

Enforcement record

No enforcement decisions could be found for this jurisdiction as of the last verification pass (22 July 2026). A country with no published enforcement is a data point, not a gap: see the 54-state publication scorecard.

Track Seychelles

Get decision alerts by email

Tell us your jurisdictions and we email you when a regulator's decision passes verification. Privacy.