Law No. 025/2023, sensitive categories of personal data and children's data

Loi n°025/2023, articles 74 à 77, 148 à 163 et 188 à 199 (catégories sensibles de données et protection des mineurs)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 15 July 2023.

A sensitive categories rule binding public and private bodies.

As of 19 September 2026.

What it requires

Process a minor's personal data only on their own consent once they turn eighteen, or otherwise only with the express authorization of the holder of parental authority, and confirm by some means that the consent you rely on is theirs.
Do not collect or process data revealing racial or ethnic origin, political, philosophical or religious opinions, trade-union membership, biometric or genetic data, or data on health or sex life, unless a listed exception applies, such as the data subject's own express consent, a non-profit body's processing of its own members, data the person made public, or preventive medicine and care administered by a bound health professional.
Process data on offences, criminal convictions and safety measures only where you are a public, judicial or public-service body acting within your legal remit, or a legal auxiliary acting for the defense of the person concerned.
Before processing personal data for a public-interest research, study or evaluation purpose in the health domain, obtain the APDPVP's authorization, given after the health-research consultative committee opines on your methodology and the necessity and relevance of the data.
Before collecting a child's personal data through a search engine, website, platform, application, or connected or geolocation service, obtain the prior consent of the child's parent or the person holding parental responsibility.
Do not profile a child, except where the APDPVP has authorized it on a motivated opinion for the child's best interest or on a public-interest ground.
Treat as void, on a challenge before the competent court, a contract a child enters through an internet-based service where it is prejudicial to the child.
Where your online service is aimed at children, build in privacy-protective technical measures such as marking and filtering, write information for them in terms they can understand, keep advertising, entertainment and games clearly distinct from content, never incite a child to buy goods or enter an online contract, and never use prizes, rewards or links to a non-compliant site to keep them engaged.

What it reaches

Obligation class

Prohibition, Consent, Biometric, Governance

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Article 74 makes processing a child's data lawful on the child's own consent once they turn eighteen, and otherwise only on the express authorization of the holder of parental authority, confirmed by the controller by any means.

Articles 75 and 76 prohibit collecting or processing data revealing racial or ethnic origin, political, philosophical or religious opinions, trade-union membership, biometric or genetic data, or data on health or sex life, unless a listed exception applies: the data subject's own express consent, safeguarding a life the person cannot consent to protect, a non-profit body's processing of its own members' data, data the person made public, establishing or defending a legal claim, preventive medicine, medical diagnosis or care administered by a professional bound by professional secrecy, statistical processing by a competent ministry's statistical service, or health research; the same article separately conditions processing genetic, biometric, or offence and conviction data on the data subject's written, informed, express consent with no risk of discrimination.

Article 77 confines processing of data on offences, convictions and safety measures to public, judicial and public-service bodies acting within their legal remit, and to legal auxiliaries defending the person concerned.

Articles 148 to 151 subject processing personal data for a public-interest research, study or evaluation purpose in the health domain to the APDPVP's authorization, given after the health-research consultative committee opines on the research methodology and the necessity and relevance of the data to it; articles 152 to 163 set the conditions for coding identifying data before transmission by a health professional, publishing results without identifying anyone, and processing health data for evaluating or analyzing care practices and health-system performance.

A dedicated children's-data chapter (articles 188 to 199) treats anyone under eighteen as a child, bars arbitrary or unlawful interference with a child's private life including online, and requires a search engine, website, platform, application or connected or geolocation service to obtain a parent's or guardian's prior consent before collecting a child's personal data; information addressed to a child must be written in terms they can understand, a child's profiling is banned outside an APDPVP-authorized exception for the child's best interest or a public-interest ground, and a contract a child enters through an internet-based service is void on a court challenge where it is prejudicial to them.

An online service aimed at children must build in privacy-protective technical measures such as marking and filtering systems, keep advertising, entertainment and games clearly distinct from content, never incite a child to buy goods or enter an online contract, and never use prizes, rewards or links to non-compliant sites to keep a child engaged.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot
processes_biometrics
processes_voice
serves_minors
high_risk_decisions

Read the law

Loi n°025/2023 du 9 juillet 2023 portant modification de la loi n°001/2011 du 25 septembre 2011 relative à la protection des données à…
Loi n°025/2023 du 9 juillet 2023 portant modification de la loi n°001/2011 du 25 septembre 2011 relative à la protection des données à caractère personnel, Journal Officiel de la République Gabonaise

archived copy

Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2025. Publisher's page: https://journal-officiel.ga/20085-025-2023-/

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app