Law No. 025/2023, rights of the data subject and transparency obligations

Loi n°025/2023, articles 43 à 69 et 91 à 110 (droits de la personne concernée et obligation de transparence)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 15 July 2023.

A data subject rights rule binding public and private bodies.

As of 19 September 2026.

What it requires

Respond to a data subject's request to access, rectify, erase, restrict, port, or object to the processing of their personal data.
Do not subject a person to a decision based solely on automated processing, including profiling, without letting them oppose it.
Act on a data-subject request within one month of receiving it, extendable by two months for complex or numerous requests provided you tell the person of the extension and its reasons within the first month; where you decline to act, tell the person why within one month and of their right to complain to the APDPVP or go to court.
Provide the information free of charge, except that you may charge a reasonable fee or refuse where a request is manifestly unfounded or excessive, in which case you carry the burden of showing that.
At collection, tell the person your identity, the data protection officer's contact details where designated, the purpose and legal basis, any legitimate interest relied on, recipients, any transfer abroad, the retention period or the criteria for it, their rights including withdrawal of consent, their right to complain to the APDPVP, and the existence and logic of any automated decision-making or profiling that concerns them.
Where you did not collect the data from the person, give them the same categories of information, including the data's origin and whether it came from a publicly accessible source, within one month, or by the time you first contact them or first disclose the data to another recipient, whichever is earliest.
Before accessing or storing information on a subscriber's or user's terminal equipment, such as through a cookie, tell them the purpose and how to object, and proceed only once they have consented, except where the access is strictly necessary to provide an electronic communication service they expressly requested.

What it reaches

Obligation class

Data subject rights, Disclosure, Consent

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Chapter III, section 1 (articles 43 to 69) gives a data subject the right of access to the data a controller holds on them, the right to rectification and to erasure, the right to have processing restricted, the right to receive their data in a portable format, the right to object to processing, and the right, at article 66, to oppose a decision based solely on automated processing, including profiling, that concerns them.

Section 2's transparency paragraph (articles 91 to 110) requires the controller to inform the person, at collection, of the controller's and any data protection officer's identity and contact details, the purpose and legal basis of processing, any legitimate interest relied on, recipients, any transfer abroad, the retention period or the criteria for it, the person's rights including withdrawal of consent, the right to complain to the APDPVP, and the existence and logic of any automated decision-making or profiling concerning them (article 98); where the data were not collected from the person, the same categories of information are owed, plus the data's origin and whether it came from a publicly accessible source, within one month or by the time of first contacting the person or first disclosing the data, whichever comes first (articles 100 to 101).

A controller must act on an access, rectification, erasure, restriction, portability or objection request within one month of receiving it, extendable by two months for complex or numerous requests provided the person is told of the extension and its reasons within the first month; declining to act requires telling the person why within one month and of their right to complain to the APDPVP or go to court (articles 93 to 94).

Information is provided free of charge, except that a manifestly unfounded or excessive request, particularly a repetitive one, lets the controller charge a reasonable fee or refuse, with the burden of showing that on the controller (article 95).

Article 104 requires anyone accessing or storing information on a subscriber's or user's terminal equipment, such as through a cookie, to tell them the purpose and how to object, and to proceed only once they have consented through their connection settings or another device they control, except where the access is strictly necessary to provide an electronic communication service they expressly requested.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot
automated_outreach
high_risk_decisions
generates_content

Read the law

Loi n°025/2023 du 9 juillet 2023 portant modification de la loi n°001/2011 du 25 septembre 2011 relative à la protection des données à…
Loi n°025/2023 du 9 juillet 2023 portant modification de la loi n°001/2011 du 25 septembre 2011 relative à la protection des données à caractère personnel, Journal Officiel de la République Gabonaise

archived copy

Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2025. Publisher's page: https://journal-officiel.ga/20085-025-2023-/

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app