[22nd December 2023] REPUBLIC OF SEYCHELLES Data Protection Act SUPPLEMENT TO OFFICIAL GAZETTE 650 ACT (8) Any information that is required under this Part to be provided to the data subject shall be provided free of charge, unless a request from a data subject is manifestly unfounded or excessive. (9) Where a data subject request is considered unfounded or excessive, the data controller may charge a reasonable fee for dealing with the request, or refuse to act on the request. (10) The data controller shall facilitate the data subject to exercise his or her rights both in person and through remote access, and shall implement such safeguards as may be necessary to protect data from unauthorized access, use and disclosure as well as effectively identifying the legitimate data subject. (11) The data subject shall have the right to lodge a complaint with the Commission if he or she considers that the processing of personal data relating to him or her is being or has been conducted in contravention of this Act. (12) The data subject may in addition to subsection (11) lodge a complaint to the Commission in a case where the data subject considers that his or her rights have not been sufficiently responded to. (13) The Commission shall inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy. (14) The Minister may make regulations prescribing any matters regarding the data subject's rights under this Part, including limits to fees, timelines and such other matters as the Minister may consider necessary. Right to be informed 26.(1) The data controller shall, for the purpose of enabling the exercise of a data subject's rights under this Part, give the data subject the following — (a) information about the legal basis for the processing; (b) information about the period for which the personal data will be stored or, where that is not possible, about the criteria used to determine that period;