LexLint

Know the law where your app runs.

Law / Gambia

Gambia

3 of 5 named instruments researched to a stage, across three of the six areas of law we track: 2 in force and 1 enacted but not yet in force. As of 4 September 2026.

  1. AI law none researched
  2. Privacy law 1
  3. Scraping law 1
  4. Cybersecurity law none researched
  5. Age gating law none researched
  6. News aggregation law 1

in forceenacted but not yet in forceproposedrepealed, withdrawn or blocked

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Privacy law1 instrument, 1 enacted but not yet in force

Research summary (218 words)

The Gambia's National Assembly passed the Personal Data Protection and Privacy Bill, 2025 during its Third Ordinary Session on 29 September 2025, the country's first comprehensive statute for the processing of personal data, and Tech Hive Advisory Africa's December 2025 legal review describes it as already enacted. The Act designates the Information Commission, the body the Access to Information Act, 2021 established, as its regulatory authority rather than creating a new one.

The Gambia had earlier published a non-binding Data Protection and Privacy Policy and Strategy in 2019, setting out the case for such legislation without itself creating any duty. The government-reported country factsheet on dataprotection.africa records that The Gambia has signed the ECOWAS Supplementary Act on Personal Data Protection (2010), though that instrument's own content is not described here.

The Information and Communications Act, 2009 separately requires an information and communications service provider to take technical and organisational measures to block unauthorized interception, storage, or monitoring of communications it carries, and requires a person who sends unsolicited commercial communications to give the recipient the option to unsubscribe and, on request, the identifying particulars of the source that supplied the recipient's personal information; both are sectoral duties on telecommunications and electronic-commerce actors that predate and sit alongside the 2025 Act rather than a comprehensive regime of their own.

Comprehensive regime

Personal Data Protection and Privacy Act, 2025

Personal Data Protection and Privacy Act, 2025Tech Hive Advisory Africa's legal review of the Act

Commencement not set. Binds public and private bodies.

What this law does

The National Assembly of The Gambia passed the Personal Data Protection and Privacy Bill, 2025 during its Third Ordinary Session on 29 September 2025, establishing the country's first comprehensive legal framework for the processing of personal data. The Act designates the Information Commission, the body the Access to Information Act, 2021 already established, as the regulatory authority for this Act rather than creating a new agency.

Processing of sensitive personal data, including genetic and biometric data and data revealing racial origin, political opinions, or health status, is generally prohibited unless the controller identifies a lawful basis and satisfies one of the Act's listed conditions, such as explicit consent.

A controller must notify the Commission within seventy-two hours of becoming aware of a security breach and must also notify affected data subjects without undue delay where the breach carries a high risk to their rights. A data subject has the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning them or significantly affects them.

Transfer of personal data outside The Gambia proceeds primarily on an adequacy finding for the receiving country or organisation, or otherwise on appropriate safeguards where no such finding exists.

Unlawful processing of personal data for financial gain or to cause harm is a criminal offence, and the unlawful sale of personal data carries a heavier criminal penalty again, with concealment of a security breach and obstruction of the Commission's investigation each carrying their own separate criminal exposure. This summary rests on a legal-advisory firm's published review of the Act rather than its own gazetted text.

What it requires

Scraping law1 instrument, 1 in force

Research summary (204 words)

The Gambia's Information and Communications Act, 2009 (No. 2 of 2009) carries a dedicated Computer Misuse and Cyber Crime part reaching unauthorised access to computer data, unauthorised access to and interception of a computer service, unauthorised modification of computer material, damaging or denying access to a computer system, unlawful possession of hacking devices or data, and unauthorised disclosure of a password, each a criminal offence rather than a civil wrong.

The Gambia has no located terms-of-service enforceability doctrine, database right, text-and-data-mining exception, or robots.txt-specific rule; the Copyright Act, 2004's general reproduction and quotation exceptions are a copyright question rather than a computer-misuse one, and a personal-data duty reaching data collected from public sources attaches to the data itself, under the Personal Data Protection and Privacy Act, 2025, rather than to the collection method.

A Cybercrime Bill, 2023 that would add procedural powers, including compelled decryption and interception assistance, and international-cooperation provisions to this regime was tabled at the National Assembly for a first and second reading in March 2024 and referred to the Assembly's Select Committee on ICT and Education, which was still holding consultations per a Ministry retreat reported on 14 May 2024; whether it has since been enacted is not established here.

Computer misuse

Information and Communications Act, 2009, Computer Misuse and Cyber Crime part

Information and Communications Act, 2009 (No. 2 of 2009), Chapter III, Part III (Computer Misuse and Cyber Crime, ss. 163-169)Information and Communications Act

In force since 29 May 2009. Binds public and private bodies.

What this law does

A person who causes a computer system to perform a function knowing that the access is unauthorised commits an offence, unless the person has a right to control the operation or use of the computer system and exercises that right.

Securing access to a computer system for the purpose of obtaining a computer service, or intercepting any function of or data within a computer system, is also an offence unless both the sender and intended recipient of the data have given consent or the actor is exercising a statutory power.

Causing an unauthorised modification of data held in a computer system, or, without lawful authority or excuse, degrading, interrupting, or denying access to a computer system or the data held in it, are each separate offences.

Manufacturing, selling, importing, distributing, or possessing a device or data designed or adapted primarily to commit any of these offences is itself an offence, as is knowingly disclosing a password or access code for wrongful gain, an unlawful purpose, or knowing it is likely to cause prejudice. It is immaterial to any of these offences whether the access or interception was directed at a particular program or data, or at any program or data at all.

What it requires

News aggregation law1 instrument, 1 in force

Research summary (174 words)

The Gambia has no press-publisher neighbouring right, no compelled platform-to-publisher bargaining code, no recognized hot-news misappropriation doctrine distinct from ordinary copyright law, and no machine-readable text-and-data-mining opt-out mechanism; each of those is a sourced absence rather than an unresolved question, and no Gambian court decision on hyperlinking or framed display is reported either.

The relevant instrument is the Copyright Act, 2004, whose section 29 permits the reproduction, in the form of quotation, of a short part of a published work without the authorisation of the author or other owner of copyright, provided the reproduction is compatible with fair practice and does not exceed the extent justified by the purpose. Section 29 names no permitted purposes and no news or press-summary use.

An indication of the source and the name of the author or other owner of copyright, where that name appears in the work quoted, must accompany the quotation. Whether this exception reaches a systematic aggregator's reproduction of headlines and snippets, as opposed to an ordinary quotation, is not established in the Act's text.

This page covers the instruments LexLint has researched to a stage. Instruments named in the corpus but not yet researched are counted in the head and are not listed here. Every entry carries its own primary source on its note page. This is a research index, not legal advice.