Law No. 025/2023, recourse, oversight and sanctions

Loi n°025/2023, articles 200 à 214 (recours, contrôle et sanctions)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 15 July 2023.

An enforcement supervision rule binding public and private bodies.

As of 19 September 2026.

What it requires

Expect the APDPVP's members and sworn, authorized agents to access your professional premises used for processing, accompanied by judicial police officers with the public prosecutor informed in advance, and expect a court order to be needed only if you oppose the visit.
Produce any document the APDPVP's members or agents request for their mission, and let them access your programs and data for control purposes.
Expect a warning, then a formal notice to end a breach within a set period, then a financial penalty, for failing to meet a duty under the law; a first breach is capped at 98,400,000 FCFA and, on repetition, at 300,000,000 FCFA or 5% of a company's last closed-year turnover up to 196,000,000 FCFA, alongside a provisional processing suspension that becomes definitive after three months.
Where you already hold a declaration receipt or an authorization and breach the law, expect its suspension for up to two months and then its definitive withdrawal, alongside a fine of 1,000,000 to 100,000,000 FCFA; operating without ever having filed makes you a de facto controller facing the same fine.
Expect the APDPVP to order, without a prior notice-and-cure period, the interruption of a processing operation, the locking of data, a temporary ban of up to three months, or a definitive ban, wherever it finds the processing violates rights and freedoms.
Appeal a sanction or decision of the APDPVP to the Conseil d'Etat.
Expect a data subject to be able to sue you or your processor in the competent courts after first bringing the matter to the APDPVP, including through a nongovernmental organization or association working in data protection that the person mandates; the APDPVP itself cannot award compensation.
Expect criminal offences arising from a breach of the law to be punished under the Penal Code, and expect six months' to a year's imprisonment and a fine of 1,000,000 to 10,000,000 FCFA, doubled on repetition, for obstructing the APDPVP's own action.

If you get it wrong

Criminal exposureYes

Private right of actionYes

Criminal exposure note

Loi n°025/2023 art. 212 refers the criminal offences arising from a breach of the law to the Penal Code generally; art. 213 separately punishes obstructing the APDPVP's own action (opposing its members or agents, or refusing to communicate or concealing documents useful to their mission) with six months to one year of imprisonment and a fine of 1,000,000 to 10,000,000 FCFA.

Penalty structure

The APDPVP's administrative fine for unlawful processing runs 1,000,000 to 100,000,000 FCFA, proportioned to the gravity of the breach and the advantage drawn from it; a first breach is capped at 98,400,000 FCFA, and on repetition the cap rises to 300,000,000 FCFA, or, for a company, 5% of its last closed financial year's turnover excluding tax, itself limited to 196,000,000 FCFA. A controller with no declaration or authorization on file, or one that keeps operating after suspension or withdrawal of its authorization, separately faces a fine of 1,000,000 to 100,000,000 FCFA. Obstructing the APDPVP's own action carries a separate criminal fine of 1,000,000 to 10,000,000 FCFA alongside imprisonment (see criminal_exposure_note).

Rule: Fixed only
As of: 4 September 2026
Currency: XAF
Fixed cap: 300,000,000

Who enforces it

Enforcement body

Autorité pour la Protection des Données Personnelles et de la Vie Privée (APDPVP)

What it reaches

Obligation class

Governance, Reporting

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Article 200 gives any person a non-jurisdictional and a jurisdictional recourse for a breach or violation touching their personal data, but bars the APDPVP itself from awarding compensation, which only the ordinary courts can rule on.

Articles 201 and 202 let the APDPVP's members and sworn, authorized agents, accompanied by judicial police officers with the public prosecutor informed in advance, access a controller's professional premises used for processing, demand documents, and access programs and data for control purposes, with a court order required over the premises holder's opposition.

Sanctions escalate from a warning, to a formal notice to end a breach within a set period, to a financial penalty the Authority can make public (articles 203 to 205): a first breach is capped at 98,400,000 FCFA and, on repetition, at 300,000,000 FCFA or 5% of a company's last closed financial year's turnover up to 196,000,000 FCFA, alongside a provisional suspension of collecting or processing data that becomes definitive after three months.

A controller that already holds a declaration receipt or authorization and breaches the law faces, after formal notice, suspension of that receipt or authorization for up to two months, then its definitive withdrawal, and a fine of 1,000,000 to 100,000,000 FCFA; a controller that never filed at all is a de facto controller facing the same fine alongside a formal notice to regularize (articles 206 to 207).

Article 208 lets the APDPVP order, without the notice-and-cure process, the interruption of a processing operation, the locking of data, or a temporary ban of up to three months, or a definitive ban, wherever it finds a processing operation violates rights and freedoms.

Sanctions and APDPVP decisions are appealable to the Conseil d'Etat (article 210), and any person may sue a controller or processor in the competent courts after first bringing the matter to the APDPVP, including through a nongovernmental organization or association working in data protection that the person mandates to represent them (article 211).

Criminal offences arising from a breach of the law are punished under the Penal Code (article 212), and obstructing the APDPVP's own action, by opposing its members or agents or refusing or concealing documents useful to their mission, carries six months' to a year's imprisonment and a fine of 1,000,000 to 10,000,000 FCFA, doubled on repetition (article 213).

When LexLint raises it

crawls_web
trains_models
deploys_chatbot
high_risk_decisions
is_listed_company

Read the law

Loi n°025/2023 du 9 juillet 2023 portant modification de la loi n°001/2011 du 25 septembre 2011 relative à la protection des données à…
Loi n°025/2023 du 9 juillet 2023 portant modification de la loi n°001/2011 du 25 septembre 2011 relative à la protection des données à caractère personnel, Journal Officiel de la République Gabonaise

archived copy

Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2025. Publisher's page: https://journal-officiel.ga/20085-025-2023-/

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app