Law / Gambia

Personal Data Protection and Privacy Act, 2025, transfer of personal data outside The Gambia

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

Commencement not set.

A cross border transfer rule binding public and private bodies.

As of 19 September 2026.

What it requires

Before transferring personal data out of The Gambia, confirm that the receiving country or international organisation has a law providing an appropriate level of protection, or put appropriate safeguards in place through an ad hoc or standardised instrument the Information Commission has adopted.
Assess the level of protection yourself, taking into account the nature of the data, the purpose of the transfer, and the recipient country's legal regime.
Document the assessment of the safeguards or criteria that justify each transfer out of The Gambia.

What it reaches

Obligation class

Transfer, Governance

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

The Act regulates the transfer of personal data to countries or international organisations outside The Gambia so that the level of protection it guarantees is not undermined.

The primary mechanism for transfer is adequacy, where the receiving country or international organisation has a law that provides an appropriate level of protection, and in the absence of such a law transfers may proceed based on appropriate safeguards established through ad hoc or standardised instruments adopted by the Information Commission.

The controller is responsible for assessing whether an appropriate level of protection exists, taking into account the nature of the data, the purpose of the transfer, and the recipient country's legal regime. The controller or processor must document the assessment of the appropriate safeguards or criteria that justify the transfer, and the Commission has a supervisory role in assessing whether the transfer criteria are met.

The Gambia has enacted the Personal Data Protection and Privacy Act, 2025. The Information Commission and the Ministry of Information conducted community sensitisation sessions on the newly enacted Act in November 2025. The review records the Act as enacted and names no date on which it comes into operation, so the day its duties begin to bind is not established.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot

Read the law

Tech Hive Advisory Africa's published legal review of the Personal Data Protection and Privacy Act, 2025
the Act's own gazetted text is not reproduced there

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app