Law / Gambia

Personal Data Protection and Privacy Act, 2025, rights of the data subject

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

Commencement not set.

A data subject rights rule binding public and private bodies.

As of 19 September 2026.

What it requires

Give a data subject your identity, the purposes of the processing, the recipients of the data and your legal basis, at the time you collect their personal data or within a reasonable period where you obtained it indirectly.
On request, confirm whether you are processing a person's personal data, give them a copy of it free of charge, and give them the details of the processing activities.
Correct inaccurate or incomplete personal data on demand, and update your records without undue delay.
Delete personal data on request where it is no longer necessary for the purpose you collected it for, where consent is withdrawn, or where the processing is unlawful.
Store personal data without processing it further while its accuracy is contested or another ground for restriction applies.
Cease processing personal data for direct marketing immediately upon request, and weigh any other objection made on grounds relating to the data subject's particular circumstances.
Do not base a decision that produces legal effects for a person, or otherwise significantly affects them, solely on automated processing, including profiling.

What it reaches

Obligation class

Disclosure, Data subject rights

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

A controller must provide a data subject with comprehensive details of its identity, the purposes of the processing, the recipients of the data and the legal basis for the processing, at the time of collection or within a reasonable period where the data was obtained indirectly. A data subject may request confirmation of whether their personal data is being processed and obtain a copy of that data free of charge, along with specific details about the processing activities.

A data subject may demand the correction of inaccurate or incomplete personal data, which obliges the controller to update its records without undue delay. A data subject may request deletion of personal data that is no longer necessary for the original purpose, where consent is withdrawn, or where the processing is unlawful.

A data subject may require processing to be restricted in specific circumstances, such as where the accuracy of the data is contested, so that the data is stored but not further processed until the issue is resolved. A data subject may object to processing at any time based on their particular circumstances, and has an absolute right to object to processing for direct marketing purposes, which the controller must cease immediately upon request.

A data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or significantly affects them. The Gambia has enacted the Personal Data Protection and Privacy Act, 2025. The Information Commission and the Ministry of Information conducted community sensitisation sessions on the newly enacted Act in November 2025.

The review records the Act as enacted and names no date on which it comes into operation, so the day its duties begin to bind is not established.

When LexLint raises it

high_risk_decisions
automated_outreach
deploys_chatbot
crawls_web
trains_models

Read the law

Tech Hive Advisory Africa's published legal review of the Personal Data Protection and Privacy Act, 2025
the Act's own gazetted text is not reproduced there

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app