[22nd December 2023] REPUBLIC OF SEYCHELLES Data Protection Act SUPPLEMENT TO OFFICIAL GAZETTE 666 ACT (c) the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident; and (d) a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing. (2) In order to implement the measures under subsection (1), the data controller and data processor shall take into account the latest technology available, the costs of implementation and the nature, scope, context and purpose of processing as well as the risk of varying likelihood and severity for the rights of the data subject. (3) In assessing the appropriate level of security, the data controller and data processor shall take into account the risks that are presented by processing, in particular from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data, transmitted, stored or otherwise processed. (4) The data controller and data processor shall implement measures designed to — (a) prevent unauthorised processing or unauthorised interference with the systems used in connection with it to ensure that it is possible to establish the precise details of any processing that takes place; (b) ensure that any systems used in connection with the processing function properly and may, in the case of interruption, be restored at the minimum timeframe possible, and in any case not exceeding 72 hours; and (c) prevent data corruption in case a system used in connection with the processing malfunctions or suffers a cyber vulnerability. (5) The data controller and data processor shall take steps to ensure