[22nd December 2023] REPUBLIC OF SEYCHELLES Data Protection Act SUPPLEMENT TO OFFICIAL GAZETTE 663 ACT (b) to assist with self-monitoring by the data controller or the data processor, including the conduct of internal disciplinary proceedings; (c) to ensure the integrity and security of personal data; (d) for the purposes of criminal proceedings. (5) The data controller or the data processor shall make the logs available to the Commission upon request. Blocking data 39.(1) The data controller shall block access to data when the data becomes subject to rectification or erasure. (2) The data controller shall block such data following the principles established in Part III, including by — (a) adopting such technical and organisational measures that allow him or her to comply with the principles; and (b) developing mechanisms to allow the data subjects to effectively exercise their rights under Part V. Data protection impact assessment 40.(1) Where a type of processing is likely to result in a high risk to the rights and freedoms of any individual, the data controller shall, prior to the processing, carry out a data protection impact assessment and a single assessment may address a set of similar processing operations that present similar high risks. (2) An assessment is required when — (a) a systematic and extensive evaluation of personal aspects relating to individuals which is based on automated processing, including profiling, and on which decisions are based that produce legal effects concerning the individual or significantly affect the individual;