[22nd December 2023] REPUBLIC OF SEYCHELLES Data Protection Act SUPPLEMENT TO OFFICIAL GAZETTE 644 ACT other and contribute to the quality of the data being processed. (7) Data controllers shall provide data subjects all necessary information regarding the processing to allow the data subjects to make an informed decision. (8) Data subjects may withdraw their consent for data processing at any time in a manner prescribed. (9) Data controllers shall be able to provide evidence of a data subject’s consent to processing his or her data. (10) For credit reporting systems, the credit information laws for the time in force shall regulate the specific circumstances for the giving of consent. (11) Data controllers shall not, as a condition of the supply of a product or service, require a data subject to consent to the processing of personal data beyond what is required to fulfil the specified and legal purposes. (12) Where consent is not required for processing personal data, a data controller shall still provide sufficient information to a data subject regarding the processing of the data. (13) When data is not obtained directly from the data subject, a data controller shall inform the data subject about the processing of data by a third party. (14) In certain circumstances personal information may be collected, used, or disclosed without the knowledge and consent of the individual for protecting vital interests of the data subject or another individual. (15) When data is not obtained from the data subject, such data shall remain confidential in compliance with the law. Data retention 16.(1) Personal data shall be stored for the necessary period to meet the