Processes biometric data, in the Gambia

Personal Data Protection and Privacy Act, 2025, scope, principles, lawful basis and the obligations of controllers and processors · Read the law's page

• Establish one of the Act's seven lawful bases before processing personal data, whether you are established in The Gambia or process the data of individuals in the country from outside it.
• Collect personal data only for explicit and legitimate purposes, keep it adequate and relevant to those purposes, keep it accurate and up to date, and process it securely.
• Carry out a compatibility assessment before putting personal data to a new purpose, weighing the relationship between the purposes, the context of collection, the nature of the data, the consequences for the data subject and the safeguards in place.
• Use only a processor that provides sufficient guarantees of compliance, govern the engagement by a contract setting out the subject matter, duration, nature and purpose of the processing, and do not engage a sub-processor without the controller's prior written authorisation.
• Where you determine the purposes and means of processing jointly with another controller, specify each party's compliance responsibilities.
• Design your technical and organisational measures to implement the data protection principles, and ensure that by default only the personal data necessary for each specific purpose is processed.
• Maintain a written record of your processing activities, as a controller and as a processor alike.
• Carry out a data protection impact assessment before high-risk processing such as profiling or large-scale surveillance.
• Designate a data protection officer if you are a public authority, or if you engage in large-scale monitoring or large-scale processing of sensitive data.

Personal Data Protection and Privacy Act, 2025, sensitive personal data and children's data · Read the law's page

• Do not process genetic or biometric data, or data revealing racial origin, political opinions or health status, unless you have both a lawful basis and one of the Act's listed conditions, such as the data subject's explicit consent.
• Obtain parental or guardian consent before processing the personal data of a person under the age of 18, and put that child's best interests and privacy first.
• Apply specific safeguards to any marketing or profiling directed at children, and put anything addressed to a child in clear, plain language they can easily understand.