[22nd December 2023] REPUBLIC OF SEYCHELLES Data Protection Act SUPPLEMENT TO OFFICIAL GAZETTE 662 ACT (b) the name and contact details of the data controller on behalf of which the data processor is acting; (c) where applicable, the name and contact details of the data protection officer; (d) the processing activities carried out on behalf of the data controller; (e) where applicable, details of transfers of personal data to a third country or an international organisation where explicitly instructed to do so by the data controller, including the identification of that third country or international organisation; (f) where possible, a general description of the technical and organizational security measures referred to in section 37. (6) The data controller and the data processor shall make the record kept under this section available to the Commission upon request. Logging 38.(1) A data controller or, where personal data is processed on behalf of the data controller by a data processor, the data processor, shall keep logs for all processing operations. (2) The logs of consultation shall make it possible to establish the justification for, and the date and time of, the consultation and as far as possible, the identity of the person who consulted the data. (3) The logs of disclosure shall make it possible to establish the justification for, and date and time of the disclosure and, as far as possible, the identity of the person who disclosed the data and the identity of the recipients of the data. (4) The logs kept under subsection (1) may be used only for one or more of the following purposes — (a) to verify the lawfulness of processing;