Ley de Protección de Datos Personales

Article 2 applies the Law to the personal data of any citizen recorded on any medium, in both the public and private sectors, whenever the processing occurs, or the controller is subject to Equatoguinean law, within the national territory.

Article 10 requires clear, unequivocal consent for processing, requires express written consent for a sensitive category (race, tribe or ethnicity, health, sexual life, religious, political or union creed), and lets consent be revoked without retroactive effect.

Article 13 gives every citizen a right of access to their own data within twelve months, a right to challenge automated evaluations, a right to consult the public data-protection register, a right to rectification and cancellation within fifteen days of a request, and a right to compensation for damage, enforceable in the ordinary courts for a privately held file.

Article 27 bars transferring personal data to a country without an equivalent level of legal protection unless the Órgano Rector de Protección de Datos Personales grants prior authorisation.

Article 38 sorts infractions into minor, serious, and very serious, and Article 42 sets escalating fines for each tier: 200,000 to 500,000 FCFA for a minor infraction, 500,001 to 5,000,000 FCFA for a serious one, and 5,000,001 to 15,000,000 FCFA for a very serious one, alongside non-monetary sanctions such as suspending a file's processing, seizing equipment, or permanently closing the premises.

Article 39 assigns sanctioning power to the Minister of Telecommunications and New Technologies pending the Órgano Rector's own creation by decree, and Article 30 gives the Órgano Rector, once created, inspection and sanctioning powers of its own. The Law's own final provision ties commencement to twenty days after its publication in the Official Gazette, a date this copy does not state, so no effective date beyond the 22 July 2016 signing is recorded.