Law / Gambia

Personal Data Protection and Privacy Act, 2025, sensitive personal data and children's data

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

Commencement not set.

A sensitive categories rule binding public and private bodies.

As of 19 September 2026.

What it requires

Do not process genetic or biometric data, or data revealing racial origin, political opinions or health status, unless you have both a lawful basis and one of the Act's listed conditions, such as the data subject's explicit consent.
Obtain parental or guardian consent before processing the personal data of a person under the age of 18, and put that child's best interests and privacy first.
Apply specific safeguards to any marketing or profiling directed at children, and put anything addressed to a child in clear, plain language they can easily understand.

What it reaches

Obligation class

Consent, Biometric, Design code

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

The Act imposes a stricter regime for the processing of sensitive personal data, which includes genetic and biometric data and data revealing racial origin, political opinions or health status. Processing such data is generally prohibited unless the controller identifies a lawful basis and also satisfies one of the specific conditions the Act sets out.

Those conditions include explicit consent, obligations in the field of employment and social security, vital interests where the subject is physically incapable of consenting, and reasons of substantial public interest such as public health or national security. A child is a person under the age of 18, and a controller processing a child's data must prioritise the child's best interests and privacy.

Specific safeguards are required for marketing or profiling directed at children, the lawful processing of a child's data generally requires parental or guardian consent, and all information directed at children must be in clear, plain language that they can easily understand. The Gambia has enacted the Personal Data Protection and Privacy Act, 2025. The Information Commission and the Ministry of Information conducted community sensitisation sessions on the newly enacted Act in November 2025.

The review records the Act as enacted and names no date on which it comes into operation, so the day its duties begin to bind is not established.

When LexLint raises it

processes_biometrics
processes_voice
crawls_web
trains_models
deploys_chatbot
automated_outreach

Read the law

Tech Hive Advisory Africa's published legal review of the Personal Data Protection and Privacy Act, 2025
the Act's own gazetted text is not reproduced there

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app