[22nd December 2023] REPUBLIC OF SEYCHELLES Data Protection Act SUPPLEMENT TO OFFICIAL GAZETTE 645 ACT purpose of data processing and after such period the data shall be anonymised, archived and if necessary erased from the database. (2) Data controllers shall adopt procedures, mechanisms and processes to ensure that data remains anonymous once the retention period has elapsed, using techniques such as data masking, pseudonymization, encryption or removal of personal identifiable information among others. (3) Further retention of personal data shall be lawful where it is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller, or on the grounds of public interest in the area of public health, for archiving purposes in the public interest, for scientific or historical research purposes or statistical purposes or for the establishment or exercise or defence of legal claims. (4) The Minister may make regulations related to specific data retention periods for different types of purposes in compliance with other laws of Seychelles. Data minimisation 17.(1) Personal data processed shall be kept to the minimum necessary to meet the purposes specified by the data controller. (2) Every data controller shall disclose the specific purpose or purposes for data processing that shall be compatible with the purposes of disclosure to third parties, unless additional legal basis for such disclosure is established. Data quality 18.(1) date. Personal data shall be processed free of error, complete and up to (2) Personal data may be collected, used and disclosed only for purposes — (a) that are specific and appropriate in the circumstances;