[22nd December 2023] REPUBLIC OF SEYCHELLES Data Protection Act SUPPLEMENT TO OFFICIAL GAZETTE 643 ACT (b) it is necessary for the performance of contractual obligations between the data controller and the data subject; (c) a specific law requires the processing of personal data by the data controller to comply with its provisions; (d) it is necessary to protect vital interests of the data subject or of another natural person; (e) it is conducted in the context of the public interest and a legal framework in support of such public interest; (f) processing of personal data responds to the legitimate interests of the data controller or a third party; (g) processing is necessary for the administration of justice, or public function in a state of emergency when the processing is conducted for the benefit of the data subject. (3) Where consent is required for the processing of personal data, consent shall be obtained in an informed, free and explicit manner. (4) Data controllers shall develop policies, procedures and processes that enable the data subject to provide consent in an intelligible and userfriendly manner, and systems developed by the data controllers shall be designed in such manner as to allow consent to be given under this section. (5) When combining data from different sources data controllers shall develop a layered approach to consent, allowing data subjects to choose between categories of data to be processed and the data controllers based on the specific purposes for data processing. (6) The layered approach in subsection (5) shall not apply under the following circumstances — (a) when limiting data items can affect the purpose of the processing or impede such processing; or (b) when categories of information are complementary to each