Sends automated texts, in the Gambia

Personal Data Protection and Privacy Act, 2025, rights of the data subject · Read the law's page

• Give a data subject your identity, the purposes of the processing, the recipients of the data and your legal basis, at the time you collect their personal data or within a reasonable period where you obtained it indirectly.
• On request, confirm whether you are processing a person's personal data, give them a copy of it free of charge, and give them the details of the processing activities.
• Correct inaccurate or incomplete personal data on demand, and update your records without undue delay.
• Delete personal data on request where it is no longer necessary for the purpose you collected it for, where consent is withdrawn, or where the processing is unlawful.
• Store personal data without processing it further while its accuracy is contested or another ground for restriction applies.
• Cease processing personal data for direct marketing immediately upon request, and weigh any other objection made on grounds relating to the data subject's particular circumstances.

Personal Data Protection and Privacy Act, 2025, scope, principles, lawful basis and the obligations of controllers and processors · Read the law's page

• Establish one of the Act's seven lawful bases before processing personal data, whether you are established in The Gambia or process the data of individuals in the country from outside it.
• Collect personal data only for explicit and legitimate purposes, keep it adequate and relevant to those purposes, keep it accurate and up to date, and process it securely.
• Carry out a compatibility assessment before putting personal data to a new purpose, weighing the relationship between the purposes, the context of collection, the nature of the data, the consequences for the data subject and the safeguards in place.
• Use only a processor that provides sufficient guarantees of compliance, govern the engagement by a contract setting out the subject matter, duration, nature and purpose of the processing, and do not engage a sub-processor without the controller's prior written authorisation.
• Where you determine the purposes and means of processing jointly with another controller, specify each party's compliance responsibilities.
• Design your technical and organisational measures to implement the data protection principles, and ensure that by default only the personal data necessary for each specific purpose is processed.
• Maintain a written record of your processing activities, as a controller and as a processor alike.
• Carry out a data protection impact assessment before high-risk processing such as profiling or large-scale surveillance.
• Designate a data protection officer if you are a public authority, or if you engage in large-scale monitoring or large-scale processing of sensitive data.

Personal Data Protection and Privacy Act, 2025, sensitive personal data and children's data · Read the law's page

• Do not process genetic or biometric data, or data revealing racial origin, political opinions or health status, unless you have both a lawful basis and one of the Act's listed conditions, such as the data subject's explicit consent.
• Obtain parental or guardian consent before processing the personal data of a person under the age of 18, and put that child's best interests and privacy first.
• Apply specific safeguards to any marketing or profiling directed at children, and put anything addressed to a child in clear, plain language they can easily understand.