GabonLaw No. 025/2023, personal-data breach notification
Loi n°025/2023, articles 142 à 147 (violation de données à caractère personnel)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2025. Publisher's page: https://journal-officiel.ga/20085-025-2023-/In force since .
A breach notification rule binding public and private bodies.
- Obligation class
- Breach notice, Reporting
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
What it requires
- Notify the APDPVP without delay of a personal-data breach, describing its nature, the categories and approximate number of data subjects and records concerned where possible, the data protection officer's or another contact point's details, the likely consequences, and the measures taken or proposed to address it; the law sets no numeric deadline for this notice.NIST Privacy FrameworkCM.AW-P7
- Accompany a notification to the APDPVP with supporting evidence of the breach.NIST Privacy FrameworkCM.AW-P7
- As a processor, notify the controller without delay of a personal-data breach as soon as you become aware of it.NIST Privacy FrameworkCM.AW-P7
- Where a breach is likely to create a high risk to a person's rights and freedoms, inform the affected person as soon as possible, in clear and simple terms, giving at least the same information given to the APDPVP.NIST Privacy FrameworkCM.AW-P7
- Skip that communication to the person only where you had already applied protective measures rendering the affected data unintelligible, where later measures mean the high risk is no longer likely to materialize, or where it would take disproportionate effort, in which case make a public communication of equal effect instead; expect the APDPVP to be able to compel direct communication anyway after weighing the breach's gravity.
- Keep an up-to-date register of every personal-data breach, its circumstances, its impact and the remedial measures taken, and make it available to the APDPVP.NIST Privacy FrameworkPR.PO-P7
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- NIST CSF 2.0
- FINOS AIGF
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Who may demand the log
Regulator
Logging duty
The last paragraph of Article 147 requires each controller to keep an up-to-date register of data breaches stating their circumstances (French: "modalités"), their impact and the measures taken to remedy them, and to hold it at the disposal of the APDPVP, the data protection authority. These contents are not event-log fields, so the contents list is empty. Articles 142 to 146 are notification duties. The row cites no scope clause, so the territorial hook is empty.
- Kind
- Explicit
- As of
- Provision
- Article 147, last paragraph (register of every data breach, kept at the disposal of the APDPVP)
- Trigger
- security_incident
What this law does
Article 142 requires the controller, on a personal-data breach, to inform the APDPVP without delay, giving the breach's nature, the categories and approximate number of data subjects and records concerned where possible, the data protection officer's or another contact point's details, the likely consequences, and the measures taken or proposed to remedy it; article 143 requires supporting evidence of the breach to accompany that notice.
The law states no numeric deadline for this notice: it runs 'sans délai', without delay, rather than within a stated number of hours or days. Article 144 requires a processor to notify the controller of any breach without delay as soon as it becomes aware of it.
Article 145 requires the controller, where a breach is likely to create a high risk to a person's rights and freedoms, to inform that person as soon as possible, and article 146 requires the communication to describe the breach in clear and simple terms and to carry at least the information article 142 lists for the Authority.
Article 147 excuses that communication to the person only where the controller had already applied protective measures rendering the affected data unintelligible, where later measures mean the high risk is no longer likely to materialize, or where it would take disproportionate effort, in which case a public communication of equal effect substitutes for it; the APDPVP can still compel direct communication after weighing the breach's gravity.
Article 147 also requires every controller to keep an up-to-date register of personal-data breaches, their circumstances, their impact and the remedial measures taken, available to the APDPVP.
When LexLint raises it
When your app profile says your app runs an essential service or processes personal data.
Back to the example · Lint your app
Page updated .