[22nd December 2023] REPUBLIC OF SEYCHELLES Data Protection Act SUPPLEMENT TO OFFICIAL GAZETTE 647 ACT formalising contractual arrangements with data processors and third parties providing outsourcing services that require access or processing personal data. PART IV - PROCESSING SPECIAL CATEGORIES OF PERSONAL DATA Sensitive data 22.(1) Processing of personal data relating to race, ethnic origin, biometrics, genetics, political opinions, religious or philosophical beliefs or for the purpose of identifying a person's health or sex life is prohibited. (2) Subsection (1) shall not apply where — (a) the data subject has given explicit consent to the processing of that personal data for one or more specified purposes, unless the law otherwise provides that the prohibition under that subsection may not be lifted by the data subject; (b) processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the data controller or of the data subject in the field of employment and social security and social protection law; (c) processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent; (d) processing is carried out in the course of its legitimate activities with appropriate safeguards by a foundation, association or any other not-for-profit body and on condition that the processing relates solely to the members or to former members of the body or to persons who have regular contact with it in connection with its purposes and that the personal data is not disclosed outside that body without the consent of the data subject; (e) processing relates to personal data which is manifestly made public by the data subject;