The framework
The Seychelles' framework rests on the Data Protection Act 2023, with the Information Commission as the supervisory authority.
That puts the Seychelles in the global opt-in majority, where permission comes before processing and marketing waits for consent.
Key instruments
Data Protection Act 2023
Seychelles replaced its never-commenced 2003 Act with a modern 2023 law, giving the offshore-services hub a real framework.
Marketing and advertising
GDPR-influenced consent and bases. In practice that means consent before tracking or marketing outreach, documented well enough to show a regulator.
Cross-border transfers
Transfers abroad need an adequate destination or appropriate safeguards such as contractual clauses.
Enforcement and penalties
The authority can impose administrative fines. Read the ceiling together with the authority's track record, which prices the risk.