[22nd December 2023] REPUBLIC OF SEYCHELLES Data Protection Act SUPPLEMENT TO OFFICIAL GAZETTE 667 ACT that any natural person who has authorised access to personal data under their control shall ensure that such data is processed in a diligent manner for the purposes specified by the data controller. Notification of a personal data breach to the Commission 43.(1) In the case of a personal data breach, the data controller shall not later than 72 hours after having become aware of it, notify the Commission of the personal data breach, and where the notification to the Commission is not made within 72 hours, the notification shall be accompanied by reasons for the delay. (2) A data breach notification shall include — (a) a description of the nature of the personal data breach, including where possible the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned; (b) the name and contact details of the data protection officer or other contact point from whom more information may be obtained; (c) a description of the likely consequences of the personal data breach; and (d) a description of the measures taken or proposed to be taken by the data controller to address the personal data breach, including where appropriate measures to mitigate its possible adverse effects. (3) The data controller shall record the information on a personal data breach in a manner that enables the investigation process to be initiated, including the facts relating to the breach, its effects, and the remedial action taken. (4) The data controller and data processor shall collaborate with the Commission and other relevant authorities to investigate any data breach.