Processes personal data, in the Gambia

Personal Data Protection and Privacy Act, 2025, breach notification · Read the law's page

• Notify the Information Commission of a personal data breach within 72 hours of becoming aware of the breach.
• Notify each affected data subject of a personal data breach without undue delay where the breach carries a high risk to their rights.

Personal Data Protection and Privacy Act, 2025, offences, penalties and the Information Commission · Read the law's page

• Do not sell personal data, and do not process personal data unlawfully for financial gain or to cause harm: both are criminal offences under the Act.
• Expect the Information Commission to investigate complaints about your processing, to enter and search your premises under a warrant, to impose administrative sanctions and monetary fines, and to issue a binding enforcement notice.
• Do not obstruct an investigation by the Information Commission, which carries up to seven years of imprisonment.
• Compensate a data subject for material or non-material damage they suffer from an infringement of the Act, which they, or a non-profit organisation they authorise, may pursue as a judicial remedy.

Personal Data Protection and Privacy Act, 2025, rights of the data subject · Read the law's page

• Give a data subject your identity, the purposes of the processing, the recipients of the data and your legal basis, at the time you collect their personal data or within a reasonable period where you obtained it indirectly.
• On request, confirm whether you are processing a person's personal data, give them a copy of it free of charge, and give them the details of the processing activities.
• Correct inaccurate or incomplete personal data on demand, and update your records without undue delay.
• Delete personal data on request where it is no longer necessary for the purpose you collected it for, where consent is withdrawn, or where the processing is unlawful.
• Store personal data without processing it further while its accuracy is contested or another ground for restriction applies.
• Cease processing personal data for direct marketing immediately upon request, and weigh any other objection made on grounds relating to the data subject's particular circumstances.

Personal Data Protection and Privacy Act, 2025, scope, principles, lawful basis and the obligations of controllers and processors · Read the law's page

• Establish one of the Act's seven lawful bases before processing personal data, whether you are established in The Gambia or process the data of individuals in the country from outside it.
• Collect personal data only for explicit and legitimate purposes, keep it adequate and relevant to those purposes, keep it accurate and up to date, and process it securely.
• Carry out a compatibility assessment before putting personal data to a new purpose, weighing the relationship between the purposes, the context of collection, the nature of the data, the consequences for the data subject and the safeguards in place.
• Use only a processor that provides sufficient guarantees of compliance, govern the engagement by a contract setting out the subject matter, duration, nature and purpose of the processing, and do not engage a sub-processor without the controller's prior written authorisation.
• Where you determine the purposes and means of processing jointly with another controller, specify each party's compliance responsibilities.
• Design your technical and organisational measures to implement the data protection principles, and ensure that by default only the personal data necessary for each specific purpose is processed.
• Maintain a written record of your processing activities, as a controller and as a processor alike.
• Carry out a data protection impact assessment before high-risk processing such as profiling or large-scale surveillance.
• Designate a data protection officer if you are a public authority, or if you engage in large-scale monitoring or large-scale processing of sensitive data.

Personal Data Protection and Privacy Act, 2025, sensitive personal data and children's data · Read the law's page

• Do not process genetic or biometric data, or data revealing racial origin, political opinions or health status, unless you have both a lawful basis and one of the Act's listed conditions, such as the data subject's explicit consent.
• Obtain parental or guardian consent before processing the personal data of a person under the age of 18, and put that child's best interests and privacy first.
• Apply specific safeguards to any marketing or profiling directed at children, and put anything addressed to a child in clear, plain language they can easily understand.

Personal Data Protection and Privacy Act, 2025, transfer of personal data outside The Gambia · Read the law's page

• Before transferring personal data out of The Gambia, confirm that the receiving country or international organisation has a law providing an appropriate level of protection, or put appropriate safeguards in place through an ad hoc or standardised instrument the Information Commission has adopted.
• Assess the level of protection yourself, taking into account the nature of the data, the purpose of the transfer, and the recipient country's legal regime.
• Document the assessment of the safeguards or criteria that justify each transfer out of The Gambia.