GabonLaw No. 025/2023, rights of the data subject and transparency obligations
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2025. Publisher's page: https://journal-officiel.ga/20085-025-2023-/In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights, Disclosure, Consent
- Audit expectation
- none
What it requires
- Respond to a data subject's request to access, rectify, erase, restrict, port, or object to the processing of their personal data.NIST Privacy FrameworkCT.PO-P3
- Act on a data-subject request within one month of receiving it, extendable by two months for complex or numerous requests provided you tell the person of the extension and its reasons within the first month; where you decline to act, tell the person why within one month and of their right to complain to the APDPVP or go to court.NIST Privacy FrameworkCT.PO-P3
- Provide the information free of charge, except that you may charge a reasonable fee or refuse where a request is manifestly unfounded or excessive, in which case you carry the burden of showing that.NIST Privacy FrameworkCT.PO-P3
- At collection, tell the person your identity, the data protection officer's contact details where designated, the purpose and legal basis, any legitimate interest relied on, recipients, any transfer abroad, the retention period or the criteria for it, their rights including withdrawal of consent, their right to complain to the APDPVP, and the existence and logic of any automated decision-making or profiling that concerns them.NIST Privacy FrameworkCM.AW-P1
- Where you did not collect the data from the person, give them the same categories of information, including the data's origin and whether it came from a publicly accessible source, within one month, or by the time you first contact them or first disclose the data to another recipient, whichever is earliest.NIST Privacy FrameworkCM.AW-P1
- Before accessing or storing information on a subscriber's or user's terminal equipment, such as through a cookie, tell them the purpose and how to object, and proceed only once they have consented, except where the access is strictly necessary to provide an electronic communication service they expressly requested.NIST Privacy FrameworkCT.PO-P1
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Articles 43 to 65 give the data subject rights of access, rectification, erasure, restriction, portability and objection, and Articles 91 to 110 set the controller's duty to inform at collection. They place answering and informing duties on the controller. The controller must show a request is manifestly unfounded or excessive (Articles 43 and 95), which is a burden of proof and not a duty to keep a record. No article in the row asks for a log, register or audit. The row cites no scope clause, so the territorial hook is empty.
- Kind
- None
- As of
What this law does
Chapter III, section 1 (articles 43 to 65) gives a data subject the right of access to the data a controller holds on them, the right to rectification and to erasure, the right to have processing restricted, the right to receive their data in a portable format, and the right to object to processing.
Section 2's transparency paragraph (articles 91 to 110) requires the controller to inform the person, at collection, of the controller's and any data protection officer's identity and contact details, the purpose and legal basis of processing, any legitimate interest relied on, recipients, any transfer abroad, the retention period or the criteria for it, the person's rights including withdrawal of consent, the right to complain to the APDPVP, and the existence and logic of any automated decision-making or profiling concerning them (article 98); where the data were not collected from the person, the same categories of information are owed, plus the data's origin and whether it came from a publicly accessible source, within one month or by the time of first contacting the person or first disclosing the data, whichever comes first (articles 100 to 101).
A controller must act on an access, rectification, erasure, restriction, portability or objection request within one month of receiving it, extendable by two months for complex or numerous requests provided the person is told of the extension and its reasons within the first month; declining to act requires telling the person why within one month and of their right to complain to the APDPVP or go to court (articles 93 to 94).
Information is provided free of charge, except that a manifestly unfounded or excessive request, particularly a repetitive one, lets the controller charge a reasonable fee or refuse, with the burden of showing that on the controller (article 95).
Article 104 requires anyone accessing or storing information on a subscriber's or user's terminal equipment, such as through a cookie, to tell them the purpose and how to object, and to proceed only once they have consented through their connection settings or another device they control, except where the access is strictly necessary to provide an electronic communication service they expressly requested.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions or processes personal data.
Back to the example · Lint your app
Page updated .