GabonLaw No. 025/2023, recourse, oversight and sanctions
Loi n°025/2023, articles 200 à 214 (recours, contrôle et sanctions)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2025. Publisher's page: https://journal-officiel.ga/20085-025-2023-/In force since .
An enforcement supervision rule binding public and private bodies.
- Obligation class
- Governance, Reporting
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Expect the APDPVP's members and sworn, authorized agents to access your professional premises used for processing, accompanied by judicial police officers with the public prosecutor informed in advance, and expect a court order to be needed only if you oppose the visit.
- Produce any document the APDPVP's members or agents request for their mission, and let them access your programs and data for control purposes.
- Expect a warning, then a formal notice to end a breach within a set period, then a financial penalty, for failing to meet a duty under the law; a first breach is capped at 98,400,000 FCFA and, on repetition, at 300,000,000 FCFA or 5% of a company's last closed-year turnover up to 196,000,000 FCFA, alongside a provisional processing suspension that becomes definitive after three months.
- Where you already hold a declaration receipt or an authorization and breach the law, expect its suspension for up to two months and then its definitive withdrawal, alongside a fine of 1,000,000 to 100,000,000 FCFA; operating without ever having filed makes you a de facto controller facing the same fine.
- Expect the APDPVP to order, without a prior notice-and-cure period, the interruption of a processing operation, the locking of data, a temporary ban of up to three months, or a definitive ban, wherever it finds the processing violates rights and freedoms.
- Appeal a sanction or decision of the APDPVP to the Conseil d'Etat.
- Expect a data subject to be able to sue you or your processor in the competent courts after first bringing the matter to the APDPVP, including through a nongovernmental organization or association working in data protection that the person mandates; the APDPVP itself cannot award compensation.
- Expect criminal offences arising from a breach of the law to be punished under the Penal Code, and expect six months' to a year's imprisonment and a fine of 1,000,000 to 10,000,000 FCFA, doubled on repetition, for obstructing the APDPVP's own action.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Loi n°025/2023 art. 212 refers the criminal offences arising from a breach of the law to the Penal Code generally; art. 213 separately punishes obstructing the APDPVP's own action (opposing its members or agents, or refusing to communicate or concealing documents useful to their mission) with six months to one year of imprisonment and a fine of 1,000,000 to 10,000,000 FCFA.
Penalty structure
The APDPVP's administrative fine for unlawful processing runs 1,000,000 to 100,000,000 FCFA, proportioned to the gravity of the breach and the advantage drawn from it; a first breach is capped at 98,400,000 FCFA, and on repetition the cap rises to 300,000,000 FCFA, or, for a company, 5% of its last closed financial year's turnover excluding tax, itself limited to 196,000,000 FCFA. A controller with no declaration or authorization on file, or one that keeps operating after suspension or withdrawal of its authorization, separately faces a fine of 1,000,000 to 100,000,000 FCFA. Obstructing the APDPVP's own action carries a separate criminal fine of 1,000,000 to 10,000,000 FCFA alongside imprisonment (see the criminal exposure note).
- Rule
- Fixed only
- As of
- Currency
- XAF
- Fixed cap
- 300,000,000
Who enforces it
Enforcement body
Autorité pour la Protection des Données Personnelles et de la Vie Privée (APDPVP)
Settledness
- As of
- Open questions
- Does the limit of 196,000,000 FCFA in article 204 ("dans la limite de cent quatre-vingt-seize millions de francs CFA") cap only the 5% turnover leg of the repeat-breach ceiling, or the whole financial penalty alongside the 300,000,000 FCFA figure?
- Must the APDPVP have ruled on the matter before a court action under article 211 may be brought, given that article 211 allows an action "après saisine de l’APDPVP" without saying whether a decision is awaited?
- Which offences of the Penal Code does article 212 reach when it punishes "les infractions pénales résultants de la violation des dispositions de la présente loi" "conformément aux dispositions du code pénal"?
What it makes you log
Logging duty
Articles 200 to 214 set recourse, the APDPVP's control powers and the sanctions. Article 202 lets the APDPVP's members and agents demand any document needed for their mission and take a copy, access programs and data, and have processing transcribed into usable documents, and Article 201 gives access to premises. These are the regulator's powers and the clauses name no record the controlled party must keep, so the row states no record duty and the check is at the regulator's discretion. The row cites no scope clause, so the territorial hook is empty.
- Kind
- None
- As of
What this law does
Article 200 gives any person a non-jurisdictional and a jurisdictional recourse for a breach or violation touching their personal data, but bars the APDPVP itself from awarding compensation, which only the ordinary courts can rule on.
Articles 201 and 202 let the APDPVP's members and sworn, authorized agents, accompanied by judicial police officers with the public prosecutor informed in advance, access a controller's professional premises used for processing, demand documents, and access programs and data for control purposes, with a court order required over the premises holder's opposition.
Sanctions escalate from a warning, to a formal notice to end a breach within a set period, to a financial penalty the Authority can make public (articles 203 to 205): a first breach is capped at 98,400,000 FCFA and, on repetition, at 300,000,000 FCFA or 5% of a company's last closed financial year's turnover up to 196,000,000 FCFA, alongside a provisional suspension of collecting or processing data that becomes definitive after three months.
A controller that already holds a declaration receipt or authorization and breaches the law faces, after formal notice, suspension of that receipt or authorization for up to two months, then its definitive withdrawal, and a fine of 1,000,000 to 100,000,000 FCFA; a controller that never filed at all is a de facto controller facing the same fine alongside a formal notice to regularize (articles 206 to 207).
Article 208 lets the APDPVP order, without the notice-and-cure process, the interruption of a processing operation, the locking of data, or a temporary ban of up to three months, or a definitive ban, wherever it finds a processing operation violates rights and freedoms.
Sanctions and APDPVP decisions are appealable to the Conseil d'Etat (article 210), and any person may sue a controller or processor in the competent courts after first bringing the matter to the APDPVP, including through a nongovernmental organization or association working in data protection that the person mandates to represent them (article 211).
Criminal offences arising from a breach of the law are punished under the Penal Code (article 212), and obstructing the APDPVP's own action, by opposing its members or agents or refusing or concealing documents useful to their mission, carries six months' to a year's imprisonment and a fine of 1,000,000 to 10,000,000 FCFA, doubled on repetition (article 213).
When LexLint raises it
When your app profile says your app is a listed company or processes personal data.
Back to the example · Lint your app
Page updated .