[22nd December 2023] REPUBLIC OF SEYCHELLES Data Protection Act 670 SUPPLEMENT TO OFFICIAL GAZETTE ACT (2) The data protection officer shall act as the contact point for the Commission on issues relating to processing, including consultation, investigations, audits or any other aspect that the Commission deems necessary in relation to the data protection laws. (3) The data protection officer shall act as the main focal point to the data subjects’ complaints, and shall be responsible for establishing adequate mechanisms to adopt handling of disputes. PART VII -TRANSFERS OF DATA TO THIRD PARTIES Cross-border data flows 47.(1) Personal data shall not be transferred to a country or territory outside Seychelles unless the data processor in the recipient country or territory ensures a comparable level of protection for the rights and freedoms of data subjects in relation to the processing of personal data. (2) To establish a comparable level of protection, the Commission shall take into consideration the following — (a) the nature of the personal data; (b) the purposes and period of time the data is intended to be processed; (c) the law in force in the country of destination of the data; (d) any cross-border privacy rules scheme; and (e) any international agreements regarding data protection signed by the data controller in the country of destination of the data. (3) Personal data of Seychellois citizens pertaining to the special categories as specified under section 23 shall only be processed subject to the following — (a) there is a designated data controller accountable for crossborder data processing in Seychelles;