[22nd December 2023] REPUBLIC OF SEYCHELLES Data Protection Act SUPPLEMENT TO OFFICIAL GAZETTE 665 ACT (3) Where the data controller is required to consult the Commission under subsection (2), the data controller shall give the Commission the data protection impact assessment prepared under section 41, and any other information requested by the Commission to enable the Commission to make an assessment of the compliance of the processing with the requirements of this Part. (4) Where the Commission is of the opinion that the intended processing referred to in subsection (1) would infringe upon a provision of this Part, the Commission shall leverage the powers conferred by this Act, and shall provide written advice to the data controller and, where the data controller is using a data processor, to the data processor. (5) The written advice provided under subsection (4) shall be made before the end of a period of 6 weeks beginning with the receipt of the request for consultation by the data controller or the data processor. (6) The Commission may extend the period of 6 weeks under subsection (5) by a further period of 1 month, taking into account the complexity of the intended processing. (7) If the Commission extends the period under subsection (6), the Commission shall inform the data controller and, where applicable, the data processor, of any such extension before the end of the period of 1 month beginning with the receipt of the request for consultation, and provide reasons for the delay. Security of processing 42.(1) The data controller and data processor shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risks arising from the processing of personal data, including — (a) the pseudonymization and encryption of personal data; (b) the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services;