[22nd December 2023] REPUBLIC OF SEYCHELLES Data Protection Act SUPPLEMENT TO OFFICIAL GAZETTE 671 ACT (b) the transfer is made between intra group schemes and the headquarters is located outside Seychelles; (c) the data controller or data processor has informed the data subjects about the location of the data processing and all other relevant information as specified under section 27; (d) the transfer is necessary to protect vital interests of the data subject. (4) The Commission may, by regulations specify — (a) the circumstances under which a transfer of personal data to another country or international organisation is to be considered necessary to meet public interest reasons; and (b) restrictions to the transfer of a category of personal data to another country or international organisation. (5) The Commission may authorise the processing or transfer of personal data to another country, provided that it is part of a cross border privacy rules system that ensures — (a) cross-border rules system standards are legally enforceable against the data controllers and data processors as part of the certification system; (b) data controllers and data processors have implemented security measures using a risk-based approach proportional to the probability of the threat and severity of the harm, the confidential nature of the information processed and the number of data subjects affected. (6) The Commission may prohibit the transfer of data under this section as may be necessary in the public interest. PART VIII - OFFENCES AND PENALTIES Unlawful disclosure of personal data 48.(1) A data controller who, without a lawful justification discloses