[22nd December 2023] REPUBLIC OF SEYCHELLES Data Protection Act SUPPLEMENT TO OFFICIAL GAZETTE 664 ACT (b) processing on a large scale of special categories of data referred to under section 23; (c) there is a systematic monitoring of a publicly accessible area on a large scale; (d) there exist any other circumstances as specified by the Commission in the implementation of this Act. (3) A data protection impact assessment shall include the following — (a) a general description of the envisaged processing operations, their purpose, and legitimate interest pursued by the data processor; (b) an assessment of the risks to the rights and freedoms of the data subjects; (c) the measures envisaged to address those risks; and (d) safeguards, security measures and mechanisms to ensure the protection of personal data and to demonstrate compliance with this section, taking into account the rights and legitimate interests of the data subjects and other persons concerned. (4) In deciding whether a type of processing is likely to result in a high risk to the rights and freedoms of any individual, the data controller shall take into account the nature, scope, context and purposes of the processing. Prior consultation 41.(1) This section applies where a data controller intends to create a filing system and process personal data forming part of it. (2) The data controller shall consult the Commission prior to the processing if a data protection impact assessment prepared under section 41 indicates that the processing of the data may result in a high risk to the rights and freedoms of individuals.