[22nd December 2023] REPUBLIC OF SEYCHELLES (b) Data Protection Act SUPPLEMENT TO OFFICIAL GAZETTE 646 ACT that the individual has been informed of under section 15. (3) Data controllers processing personal data shall adequately inform data subjects of — (a) the purposes for the collection of information; (b) the name of the organisation and the procedures to follow to exercise any rights established under section 15. Access, requests and correction of data 19. Data subjects shall have the right to access, request correction or deletion of data, block access to their data and oppose the usage of their data for specific purposes and request data controllers to permit usage of their data to a third party. Data security and confidentiality 20.(1) Data controllers and data processors shall implement technical, organisational and physical measures to manage security risks arising from the processing of personal data. (2) Personal data processed under this Act shall be confidential and shall not be disclosed in any manner that contravenes this Act. (3) The Minister may make regulations setting specific security standards that need to be adhered to under this section. Accountability for data processing activities 21.(1) Data controllers and data processors are responsible for the processing of personal data and shall be accountable for the data processing activities. (2) For the purposes of subsection (1), data controllers and data processors shall implement measures that guarantee data protection and adoption of privacy through design and security measures. (3) Data controllers shall maintain appropriate documentation and record keeping for all the data processing of related activities as well as