[22nd December 2023] REPUBLIC OF SEYCHELLES Data Protection Act SUPPLEMENT TO OFFICIAL GAZETTE 639 ACT (b) specify the measures that shall be taken to remedy or eliminate the situation that may cause the contravention to arise; (c) specify a period which shall not be less than 21 days within which those measures shall be implemented; and (d) state that a right of appeal against the enforcement notice is available under section 13, and if such appeal is brought, such measure need not be taken pending the determination or withdrawal of the appeal. (3) If by reason of special circumstances the Commission considers that the steps required by an enforcement notice should be taken as a matter of urgency, the Commission may include a statement to that effect in the notice, and, in that event, subsection (2) (c) shall not apply. (4) On complying with an enforcement notice, the relevant data controller or data processor, shall, not later than 21 days after compliance, notify — (a) the data subject concerned; and (b) where such compliance materially modifies the data concerned, any person to whom the data was disclosed during the period beginning 12 months before the date of the service of the notice and ending immediately before compliance, of any amendment. (5) The Commission may vary the notice and, where this is done, the Commission shall give written notice to the person on whom the notice was served. (6) The Commission may cancel an enforcement notice by written notification to the person on whom it was served, providing the reasons for the cancellation of the enforcement notice. (7) Any person who fails to comply with an enforcement notice commits an offence and shall be liable on conviction to a fine not exceeding level 5 on the Standard Scale.