Personal Data Protection and Privacy Act, 2025, personal data breach notification

Personal Data Protection and Privacy Act, 2025, breach notification

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

Commencement not set.

A breach notification rule binding public and private bodies.

As of 19 September 2026.

What it requires

Notify the Information Commission of a personal data breach within 72 hours of becoming aware of the breach.
Notify each affected data subject of a personal data breach without undue delay where the breach carries a high risk to their rights.

If you get it wrong

Criminal exposureYes

Criminal exposure note

Concealment of a security breach is an offence carrying a potential two-year prison term.

What it reaches

Obligation class

Breach notice, Reporting

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

The Act sets a strict timeline for reporting breaches. A controller must notify the Information Commission within 72 hours of becoming aware of a breach. A controller must also notify affected data subjects without undue delay if there is a high risk to their rights. Concealment of a security breach is a criminal offence carrying a potential two-year prison term. The Gambia has enacted the Personal Data Protection and Privacy Act, 2025.

The Information Commission and the Ministry of Information conducted community sensitisation sessions on the newly enacted Act in November 2025. The review records the Act as enacted and names no date on which it comes into operation, so the day its duties begin to bind is not established.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot
automated_outreach
processes_biometrics

Read the law

Tech Hive Advisory Africa's published legal review of the Personal Data Protection and Privacy Act, 2025
the Act's own gazetted text is not reproduced there

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app