[22nd December 2023] REPUBLIC OF SEYCHELLES Data Protection Act SUPPLEMENT TO OFFICIAL GAZETTE 669 ACT (4) Where the data controller has not already communicated the personal data breach to the data subject, the Commission may, after having considered the likelihood of the personal data breach resulting in a high risk, require it to do so. Data protection officer 45.(1) when — The data controller shall designate a data protection officer (a) the core activities of the data controller or the data processor consist of processing operations which, by virtue of their nature, their scope or their purposes, require regular and systematic monitoring of the data subjects on a large scale; or (b) the core activities of the data controller or the data processor consist of processing on a large scale of special categories of data under Part IV. (2) For other activities not falling under subsection (1), the data controller may designate a data protection officer, who shall be subject to the same regime as those data protection officers designated under subsection (1). (3) When designating a data protection officer, the data controller shall have regard to the professional qualities of the proposed officer, in particular the proposed officer’s expert knowledge of data protection law and practice, and the ability of the proposed officer to perform the tasks under section 47. (4) For the avoidance of any doubt the same person may be designated as a data protection officer by several data controllers, taking into account their organisational structure and size. Tasks of the data protection officer 46.(1) The data protection officer shall monitor compliance with the data controller’s policies on the protection of personal data and monitor compliance with this Act.