[22nd December 2023] REPUBLIC OF SEYCHELLES Data Protection Act SUPPLEMENT TO OFFICIAL GAZETTE 659 ACT it or to replace any of them, to afford the data controller an opportunity to object to the proposal if the data controller wishes to. (4) The processing by a data processor shall be governed by a contract in writing between the data controller and the data processor setting out the following — (5) shall — (a) the subject-matter and duration of the processing; (b) the nature and purpose of the processing; (c) the type of personal data and categories of data subjects involved; and (d) the obligations and rights of the data controller and data processor. The contract shall, in particular, provide that the data processor (a) act only on instructions from the data controller; (b) ensure that the persons authorised to process personal data are subject to an appropriate duty of confidentiality; (c) assist the data controller to ensure compliance with the rights of the data subject; (d) at the end of the provision of services by the data processor to the data controller — (e) (i) delete or return to the data controller (at the choice of the data controller) the personal data to which the services relate, and (ii) delete copies of the personal data unless subject to a legal obligation to store the copies; make available to the data controller all the information necessary to demonstrate compliance with this section; and