Personal Data Protection and Privacy Act, 2025, the Information Commission, offences and penalties

Rather than creating a new agency from scratch, the Act designates the Information Commission, established under the Access to Information Act, 2021, as the regulatory authority. The Commission is granted independence and extensive powers, including the authority to investigate complaints and conduct separate inquiries, to enter and search premises with warrants, to impose administrative sanctions and monetary fines, and to issue binding enforcement notices.

Its administrative sanctions include corrective warnings, enforcement notices, bans on processing, and financial penalties calculated by the Commission. Unlawful processing of data for financial gain or to cause harm attracts a prison term of up to three years or a fine of not less than 500,000 Dalasis. The sale of personal data carries a penalty of up to five years imprisonment for individuals, while corporate bodies face fines of not less than 1,000,000 Dalasis or 5% of their gross income.

Aggravated offences, such as unlawfully selling data, can result in imprisonment of up to 10 years and fines of not less than 10,000,000 Dalasis for corporations. Obstruction of the Commission's investigation carries up to seven years of imprisonment.

A data subject has the right to lodge complaints and the right to compensation for material or non-material damage suffered as a result of an infringement of the Act, and may authorise a non-profit organisation to lodge complaints or pursue judicial remedies on their behalf. The Gambia has enacted the Personal Data Protection and Privacy Act, 2025. The Information Commission and the Ministry of Information conducted community sensitisation sessions on the newly enacted Act in November 2025.

The review records the Act as enacted and names no date on which it comes into operation, so the day its duties begin to bind is not established.