Activate a controlled response
Nominate legal, technical, security and communications leads. Open a decision log and preserve system records. The first objective is not to assign blame; it is to understand what happened, contain continuing access and protect reliable evidence.
Confirm the facts without delay
Identify affected systems, information types, people, dates, access methods, recipients and countries. Distinguish confirmed facts from working assumptions. Retain logs and snapshots before routine retention or remediation steps overwrite them.
Apply the relevant legal framework
The Seychelles Data Protection Act 2023 modernised the national framework for processing personal data. A live incident may also involve contractual duties, sector rules, foreign laws or platform requirements depending on the data, controllers, processors and affected individuals.
Make and record notification decisions
Assess whether regulators, individuals, insurers, counterparties or law enforcement should be notified, by whom and when. The content must be accurate enough to help without creating unnecessary confusion. Preserve the reasoning, legal basis and facts used for every decision.
Learn and remediate
After containment, address root cause, access control, credentials, vendor gaps, retention, monitoring and training. Track corrective actions to completion and align public statements with verified facts and the legal record.
Working checklist
- Incident lead and decision log
- Preserved logs and affected-system map
- Data types and affected people
- Controllers, processors and vendors
- Countries and contractual duties
- Containment and credential actions
- Notification analysis and drafts
- Remediation owner and completion dates