[22nd December 2023] REPUBLIC OF SEYCHELLES Data Protection Act SUPPLEMENT TO OFFICIAL GAZETTE 668 ACT Communication of a personal data breach to the data subject 44.(1) Where a data breach is likely to affect a significant number of individuals and their rights and freedoms, the data controller shall promptly inform the data subject of the breach. (2) The information given to the data subject under subsection (1) shall include — (a) a description of the nature of the breach; (b) the name and contact details of the data protection officer or other contact point from whom more information may be obtained; (c) a description of the likely consequences of the personal data breach; (d) a description of the measures taken or proposed to be taken by the data controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects. (3) The duty under subsection (1) does not apply where — (a) the data controller has implemented appropriate technological and organisational protection measures which were applied to the personal data affected by the breach; (b) the data controller has taken subsequent measures which ensure that the risk to the rights and freedoms of the data subject referred to in subsection (1) is no longer likely to materialise; or (c) it would involve a disproportionate effort and the data controller has made a public communication or taken a similar measure where the data subject is informed in an equally effective manner.