[22nd December 2023] REPUBLIC OF SEYCHELLES Data Protection Act SUPPLEMENT TO OFFICIAL GAZETTE 649 ACT processing under this Act shall be carried out only under the control of official authority or when the processing is authorised by law providing for appropriate safeguards for the rights and freedoms of a data subject. PART V - DATA SUBJECT'S RIGHTS Rights of data subject 25.(1) Rights of a data subject may be exercised personally or through a legal or voluntary representative. (2) A holder of parental or custodian authority may exercise on behalf of a minor or a person with mental disabilities the rights of access, rectification, deletion, blocking, opposition, data portability or any other rights that may apply under this Act. (3) A data controller shall ensure that any information that is required under this Part to be provided to the data subject is provided in intelligible and easily accessible form, using clear and plain language. (4) Information required under this Part to be provided may be provided in any form, including electronic form. (5) Where information is provided in response to a request by the data subject, the data controller shall provide the information in the same form or such form or manner as the information was provided if it is practicable to do so. (6) Where information is provided in response to a data portability request, the data controller shall enable its Application Programming Interface (API) to be accessed by a third party. (7) Where the data controller has reasonable doubts about the identity of an individual making a request under subsection (3), (4) or (5), the data controller may — (a) request the provision of additional information to enable the data controller to confirm the identity; or (b) delay dealing with the request until the identity is confirmed.