Data Protection Act [22nd December 2023] REPUBLIC OF SEYCHELLES SUPPLEMENT TO OFFICIAL GAZETTE (d) security measures; (e) manner to exercise rights; and (f) data retention policies. 657 ACT Privacy by design 35.(1) A data controller shall, at the time of the determination of the means of processing the data, and at the time of the processing itself, implement appropriate technical and organisational measures which are designed to — (a) implement the data protection principles in an effective manner; and (b) integrate into the processing itself the safeguards necessary for that purpose. (2) In order to implement such measures, the data controller shall take into account the technology available, the cost of implementation and the nature, scope, context and purposes of processing, as well as the likelihood and severity of risks posed by the processing to rights and freedoms of natural persons and in particular, in taking such measures, the data controller shall take into account whether — (a) the processing can lead to harm to the data subject; (b) the processing can affect the rights and freedom of the data subject, or prevent him or her from exercising his or her rights on his or her personal data; (c) the processing implies an evaluation of personal data with the goal to build a profile on the data subject; (d) the processing involves the processing of data on vulnerable groups, such as minors or persons with disabilities, or the processing of special categories of data; (e) the processing involves a large number of personal data or a large number of data subjects.