Loi n°001/2011 relative à la protection des données à caractère personnel, modifiée par la loi n°025/2023
Loi n°001/2011 du 25 septembre 2011 relative à la protection des données à caractère personnel telle que modifiée et complétée par la loi n°025/2023 du 9 juillet 2023, Journal Officiel n°218 bis du 15 juillet 2023
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
In force since 15 July 2023.
A comprehensive regime rule binding public and private bodies.
As of 4 September 2026.
What it requires
- Obtain a lawful basis before collecting or processing the personal data of a person in Gabon.
- Inform the person, at collection, of the controller's identity, the purpose and legal basis of the processing, the data protection officer's contact details where one is designated, and the person's rights, including the right to withdraw consent.
- Designate a data protection officer where you are a public authority or body, carry out large-scale systematic monitoring, or process sensitive data or criminal-offence data at scale, and keep a register of processing activities.
- Put in place technical and organizational security measures adequate to the risk, with heightened measures for sensitive and biometric data, and notify the APDPVP without delay of a data breach.
- Before collecting a child's personal data through a search engine, website, platform, application, or connected service, including geolocation, obtain the prior consent of the child's parent or legal guardian.
- Do not profile a child, except where the APDPVP has authorized it in the child's best interest or on a public-interest ground.
- Where your online service is aimed at children, build in technical measures protecting their data and privacy by design, write information for them in terms they can understand, and keep advertising and marketing clearly distinct from content, never inciting a child to buy goods or enter into an online contract.
- Before transferring personal data to a foreign state, be aware the APDPVP can suspend the transfer if that state does not offer a sufficient level of protection.
- Respond to a data subject's request to access, rectify, or object to the processing of their personal data.
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Loi n°025/2023 art. 212 refers the criminal offences arising from a breach of the law to the Penal Code generally; art. 213 separately punishes obstructing the APDPVP's own action (opposing its members or agents, or refusing to communicate or concealing documents useful to their mission) with six months to one year of imprisonment and a fine of 1,000,000 to 10,000,000 FCFA.
Penalty structure
The APDPVP's administrative fine for unlawful processing runs 1,000,000 to 100,000,000 FCFA, proportioned to the gravity of the breach and the advantage drawn from it; a first breach is capped at 98,400,000 FCFA, and on repetition the cap rises to 300,000,000 FCFA, or, for a company, 5% of its last closed financial year's turnover excluding tax, itself limited to 196,000,000 FCFA. A controller with no declaration or authorization on file, or one that keeps operating after suspension or withdrawal of its authorization, separately faces a fine of 1,000,000 to 100,000,000 FCFA. Obstructing the APDPVP's own action carries a separate criminal fine of 1,000,000 to 10,000,000 FCFA alongside imprisonment (see criminal_exposure_note).
- Rule
- Fixed only
- As of
- 4 September 2026
- Currency
- XAF
- Fixed cap
- 300,000,000
Who enforces it
Enforcement body
Autorité pour la Protection des Données Personnelles et de la Vie Privée (APDPVP)
What it reaches
Obligation class
Consent, Data subject rights, Biometric, Transfer, Breach notice, Governance, Security, Design code
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Loi n°025/2023 wholly modifies and completes loi n°001/2011, setting Gabon's general rules for the collection, processing, and transfer of personal data by any public or private controller. Every controller must conform from the law's publication. A controller must designate a data protection officer where it is a public authority, carries out large-scale systematic monitoring, or processes sensitive or criminal data at scale, and must keep a register of processing activities.
Processing a child's data is lawful on the child's own consent once the child turns eighteen; below that age it needs the express authorization of the holder of parental authority. A search engine, website, platform, or connected application must obtain a parent's or guardian's prior consent before collecting a child's personal data. Profiling a child is prohibited outside a narrow exception the APDPVP authorizes for the child's best interest or a public-interest ground.
An online service aimed at children must build in privacy-protective technical measures and keep advertising and marketing clearly distinct from content. Any transfer of personal data to a foreign state can be suspended by the APDPVP where that state lacks a sufficient level of protection, and the APDPVP lifts the suspension once it finds that level established. Any person has both a non-jurisdictional and a jurisdictional recourse for a breach of their rights under the law.
The APDPVP may impose a fine of 1,000,000 to 100,000,000 FCFA, capped at 98,400,000 FCFA for a first breach and at 300,000,000 FCFA (or 5% of a company's last closed-year turnover up to 196,000,000 FCFA) on repetition, alongside criminal offences referred to the Penal Code and its own penalty for obstructing the APDPVP.
When LexLint raises it
crawls_webtrains_modelsdeploys_chatbotautomated_outreachhigh_risk_decisionsprocesses_voiceprocesses_biometricsserves_minors
Read the law
Loi n°025/2023 du 9 juillet 2023 portant modification de la loi n°001/2011 du 25 septembre 2011 relative à la protection des données à…
Loi n°025/2023 du 9 juillet 2023 portant modification de la loi n°001/2011 du 25 septembre 2011 relative à la protection des données à caractère personnel, Journal Officiel de la République Gabonaise