Data Protection Act [22nd December 2023] REPUBLIC OF SEYCHELLES SUPPLEMENT TO OFFICIAL GAZETTE 658 ACT (3) Each data controller shall implement appropriate technical and organisational measures for ensuring that, by default, only personal data which is necessary for each specific purpose of the processing is processed, and this obligation applies to — (a) the amount of personal data collected; (b) the extent of its processing; (c) the period of its storage; and (d) its accessibility. (4) In particular, the measures implemented to comply with the duty under subsection (1) shall ensure that, by default, personal data is not made accessible to an indefinite number of people without a data subject's intervention. (5) Where two or more data controllers jointly determine the purposes and means of processing data under this Act, they shall be known as joint data controllers. (6) The joint data controllers shall in a transparent manner determine their respective responsibilities for compliance with their obligations under this Act, in particular regarding the exercise of the rights of a data subject. Data processors 36.(1) A data controller may use only a data processor who provides guarantees to implement appropriate technical and organisational measures that are sufficient to secure that the processing shall meet the requirements of this Part and ensure the protection of the rights of the data subject. (2) The data processor used by a data controller shall not engage another data processor without the prior written authorisation of the data controller. (3) Where a data controller gives a general written authorisation to a data processor, the data processor shall inform the data controller if the data processor proposes to add to the number of other data processors engaged by