GabonLoi n°001/2011 relative à la protection des données à caractère personnel, modifiée par la loi n°025/2023
Loi n°001/2011 du 25 septembre 2011 relative à la protection des données à caractère personnel telle que modifiée et complétée par la loi n°025/2023 du 9 juillet 2023, Journal Officiel n°218 bis du 15 juillet 2023, articles 1 à 6, 70 à 73, 78 à 90, 111 à 141, 164 à 167, 175 à 187 et 215 à 221
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2025. Publisher's page: https://journal-officiel.ga/20085-025-2023-/In force since .
A comprehensive regime rule binding public and private bodies.
- Obligation class
- Consent, Licensing, Security, Retention, Governance
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
What it requires
- Collect and process personal data fairly and lawfully, only for determined, explicit and legitimate purposes, and keep it accurate, adequate and no longer than those purposes need.NIST Privacy FrameworkGV.PO-P1
- Have a lawful basis for processing, such as the data subject's consent, a legal obligation, a public-service mission, contract performance, or a legitimate interest that does not override the data subject's own rights and freedoms.NIST Privacy FrameworkCT.PO-P1
- Where you rely on consent, be able to demonstrate it was given and present the request clearly and separately from other terms; never treat acceptance of general terms of use or a pre-checked box as consent, and in an electronic transaction take it through an unambiguous act such as a checkbox.NIST Privacy FrameworkCT.PO-P1
- Let the data subject withdraw consent at any time without affecting the lawfulness of processing already carried out, and tell them of that right before they consent.NIST Privacy FrameworkCT.PO-P1
- Declare an automated personal-data processing activity to the APDPVP before carrying it out and wait for the Authority's receipt before starting, unless a simplified or exempt category applies; processing touching a more sensitive category instead needs the APDPVP's prior authorization or a ministerial or Council-of-Ministers decree.NIST Privacy FrameworkGV.PO-P5
- Keep processing confidential, bind everyone who processes the data under your authority to a signed written undertaking, and impose the same security and confidentiality guarantees on any processor by contract.NIST Privacy FrameworkPR.PO-P9NIST Privacy FrameworkID.DE-P3
- Implement technical and organizational security measures adapted to the risk, including pseudonymization and encryption, and regularly test, assess and evaluate their effectiveness.NIST Privacy FrameworkPR.DS-P5
- Keep a written or electronic register of your processing activities, and require the same of any processor, naming the controller, purposes, data categories, recipients, transfers and retention periods, and produce it to the APDPVP on request; an organization of fewer than ten employees is exempt unless the processing is not occasional, carries a risk to rights and freedoms, or touches sensitive or criminal-offence data.NIST Privacy FrameworkID.IM-P4
- Designate a data protection officer, notify the APDPVP of the designation, and give the officer the office, resources and independence to advise you, monitor compliance, and liaise with the APDPVP, where you are a public authority, carry out large-scale systematic monitoring, or process sensitive or criminal-offence data at scale.NIST Privacy FrameworkGV.PO-P3
- Carry out a data protection impact assessment, the study the law says must be carried out whenever processing is likely to create a high risk to the rights and freedoms of the people concerned.
- Before deploying an artificial-intelligence system, a facial-recognition or other biometric-identification system, a drone or other connected object, an electronic-signature or digital-identity service, or a national or sectoral identifier system that processes personal data, file the declaration or notice the applicable norme or decree requires with the APDPVP.
- Comply with the law from the date of its publication.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- ID.IM-P4Data actions of the systems/products/services are inventoried.
- ID.DE-P3Contracts with data processing ecosystem parties are used to implement appropriate measures designed to meet the objectives of an organization’s privacy program.
- GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such as data uses or retention periods, individuals’ prerogatives with respect to data processing) are established and communicated.
- GV.PO-P3Roles and responsibilities for the workforce are established with respect to privacy.
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- NIST CSF 2.0
- GV.RR-04Cybersecurity is included in human resources practices
- GV.SC-05Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties
- PR.DS-01The confidentiality, integrity, and availability of data-at-rest are protected
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
7 more
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Which automated processing does article 78 exempt from the declaration to the APDPVP when it excepts the processing "mentionnés aux articles 80, 81 et 82 ou à l’article 111" ("mentioned in articles 80, 81 and 82 or in article 111"), given that article 111 sets the confidentiality duty and names no category of processing?
What it makes you log
Who may demand the log
Regulator
What the log must hold
Consent or opt-out state
Logging duty
Article 119 requires the controller to keep a register of its processing activities (French: "tient un registre des activités de traitement") naming the controller, purposes, data subject and data categories, recipients, transfers, erasure time limits and security measures; Article 120 requires the processor to keep one for the processing it does for the controller; Article 122 has both make the register available to the Authority; Article 123 exempts organizations of fewer than ten employees unless the processing is not occasional, carries a risk to rights, or touches sensitive or criminal-offence data. Article 72 separately requires a controller relying on consent to be able to demonstrate that the data subject consented, so the consent state is a record content. Article 118 limits how long the data are kept, which concerns the data and not a log, so no retention value is stated. Article 4 reaches processing by a controller on Gabonese territory and processing by a controller, established or not, that uses means located in Gabon (excluding transit); both prongs turn on where the processing or the means are, so they are left out of the hook value and the hook is empty.
- Kind
- Explicit
- As of
- Provision
- Articles 119 to 122 (register of processing activities kept by the controller and by the processor, made available to the Authority), with Article 72 (the controller must be able to demonstrate consent)
- Trigger
- personal_data_processing
- consent_or_optout
What this law does
Loi n°025/2023 wholly modifies and completes loi n°001/2011, setting Gabon's general rules for the collection, processing and transfer of personal data by any public or private controller (articles 2 to 4), subject to the household-activity and transit-copy exclusions of article 5.
Processing must be fair and lawful, collected for determined and legitimate purposes, and kept accurate and no longer than those purposes need (article 70), on a lawful basis such as consent, a legal obligation, a public-service mission, contract performance, or a legitimate interest that does not override the data subject's own rights (article 71); where consent is relied on it must be demonstrable, presented clearly and separately from other terms, and, for an electronic transaction, taken by an unambiguous act rather than a pre-checked box or the general terms of sale (articles 72 to 73).
An automated processing activity is declared to the APDPVP before it starts, unless it falls under a simplified or exempt category, while processing touching the categories articles 74 and 81 to 83 list instead needs the APDPVP's prior authorization or a ministerial or Council-of-Ministers decree (articles 78 to 90); the Authority keeps a public, open-format register of every declared or authorized processing activity (article 88).
Processing is confidential, everyone who handles the data under the controller's authority signs a written confidentiality undertaking, and a processor owes the controller the same security and confidentiality guarantees by contract (articles 111 to 112).
The controller and processor must implement risk-adapted technical and organizational security measures, including pseudonymization and encryption, and regularly test their effectiveness (article 113), preserve the data's continuity and keep it no longer than its purpose needs (article 118), and keep a written or electronic register of processing activities naming the controller, purposes, data categories, recipients, transfers and retention periods, produced to the APDPVP on request; an organization of fewer than ten employees is exempt from that register unless the processing carries a risk to rights and freedoms, is not occasional, or touches sensitive or criminal-offence data (articles 119 to 123).
A controller or processor designates a data protection officer, notified to the APDPVP, where it is a public authority or body, carries out large-scale systematic monitoring, or processes sensitive or criminal-offence data at scale, and gives that officer the office, resources and independence the law describes (articles 124 to 141).
Article 6 defines a data protection impact assessment as a study that must be carried out when processing is likely to create a high risk to the rights and freedoms of the people concerned.
Processing carried out solely for literary or artistic expression, or for the professional practice of journalism observing that profession's ethical rules, falls outside the law, provided a press or broadcast body designates its own data-protection correspondent in place of the ordinary declaration (articles 164 to 167).
A further chapter conditions the deployment of an artificial-intelligence system, a digital-identity or biometric-identification service such as facial recognition, a drone or other connected object, an electronic-signature service, or a national or sectoral identifier system, on filing the declaration or notice a norme or decree sets for it with the APDPVP (articles 175 to 187).
Every controller must conform from the law's publication (article 219), and the Authority funds itself through a statutory levy on controllers and processors and issues its own code of conduct by sector (articles 216 to 221).
When LexLint raises it
When your app profile says your app processes biometric data, distributes a software product or processes personal data.
Back to the example · Lint your app
Page updated .