Law / Gambia

Personal Data Protection and Privacy Act, 2025

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

Commencement not set.

A comprehensive regime rule binding public and private bodies.

As of 4 September 2026.

What it requires

Establish a lawful basis before processing personal data of a person in The Gambia.
Do not process sensitive personal data, including genetic or biometric data or data revealing racial origin, political opinions, or health status, unless a lawful basis and one of the Act's listed conditions, such as explicit consent, are both satisfied.
Notify the Information Commission within seventy-two hours of becoming aware of a personal-data breach, and notify affected individuals without undue delay where the breach carries a high risk to their rights.
Do not base a decision that produces legal effects for a person, or otherwise significantly affects them, solely on automated processing, including profiling.
Confirm that a receiving country or organisation is covered by an adequacy finding, or put appropriate safeguards in place, before transferring personal data out of The Gambia.
Do not sell personal data or process it unlawfully for financial gain or to cause harm; both carry criminal exposure under the Act.

If you get it wrong

Criminal exposureYes

Criminal exposure note

Unlawful processing of personal data for financial gain or to cause harm carries up to three years' imprisonment or a fine of not less than 500,000 Dalasis. The unlawful sale of personal data carries up to five years' imprisonment for an individual, and a corporate body faces a fine of not less than 1,000,000 Dalasis or 5% of its gross income; an aggravated offence such as unlawfully selling data can carry up to ten years' imprisonment with a corporate fine of not less than 10,000,000 Dalasis. Concealing a security breach carries up to two years' imprisonment, and obstructing the Commission's investigation carries up to seven years' imprisonment.

What it reaches

Obligation class

Consent, Biometric, Breach notice, Transfer, Governance

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

The National Assembly of The Gambia passed the Personal Data Protection and Privacy Bill, 2025 during its Third Ordinary Session on 29 September 2025, establishing the country's first comprehensive legal framework for the processing of personal data. The Act designates the Information Commission, the body the Access to Information Act, 2021 already established, as the regulatory authority for this Act rather than creating a new agency.

Processing of sensitive personal data, including genetic and biometric data and data revealing racial origin, political opinions, or health status, is generally prohibited unless the controller identifies a lawful basis and satisfies one of the Act's listed conditions, such as explicit consent.

A controller must notify the Commission within seventy-two hours of becoming aware of a security breach and must also notify affected data subjects without undue delay where the breach carries a high risk to their rights. A data subject has the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning them or significantly affects them.

Transfer of personal data outside The Gambia proceeds primarily on an adequacy finding for the receiving country or organisation, or otherwise on appropriate safeguards where no such finding exists.

Unlawful processing of personal data for financial gain or to cause harm is a criminal offence, and the unlawful sale of personal data carries a heavier criminal penalty again, with concealment of a security breach and obstruction of the Commission's investigation each carrying their own separate criminal exposure. This summary rests on a legal-advisory firm's published review of the Act rather than its own gazetted text.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot
automated_outreach
processes_voice
processes_biometrics

Read the law

Tech Hive Advisory Africa's legal review of the Act
published 26 December 2025, corroborated by contemporaneous news reporting of the National Assembly's 29 September 2025 passage the Act's own gazetted text is not read here

Back to the example · Lint your app