GabonLaw No. 025/2023, sensitive categories of personal data and children's data
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2025. Publisher's page: https://journal-officiel.ga/20085-025-2023-/In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Prohibition, Consent, Biometric, Governance
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Process a minor's personal data only on their own consent once they turn eighteen, or otherwise only with the express authorization of the holder of parental authority, and confirm by some means that the consent you rely on is theirs.NIST Privacy FrameworkCT.PO-P1
- Do not collect or process data revealing racial or ethnic origin, political, philosophical or religious opinions, trade-union membership, biometric or genetic data, or data on health or sex life, unless a listed exception applies, such as the data subject's own express consent, a non-profit body's processing of its own members, data the person made public, or preventive medicine and care administered by a bound health professional.NIST Privacy FrameworkCT.PO-P1
- Process data on offences, criminal convictions and safety measures only where you are a public, judicial or public-service body acting within your legal remit, or a legal auxiliary acting for the defense of the person concerned.NIST Privacy FrameworkCT.PO-P1
- Before processing personal data for a public-interest research, study or evaluation purpose in the health domain, obtain the APDPVP's authorization, given after the health-research consultative committee opines on your methodology and the necessity and relevance of the data.NIST Privacy FrameworkGV.PO-P5
- Before collecting a child's personal data through a search engine, website, platform, application, or connected or geolocation service, obtain the prior consent of the child's parent or the person holding parental responsibility.NIST Privacy FrameworkCT.PO-P1
- Do not profile a child, except where the APDPVP has authorized it on a motivated opinion for the child's best interest or on a public-interest ground.NIST Privacy FrameworkCT.PO-P1
- Treat as void, on a challenge before the competent court, a contract a child enters through an internet-based service where it is prejudicial to the child.
- Where your online service is aimed at children, build in privacy-protective technical measures such as marking and filtering, write information for them in terms they can understand, keep advertising, entertainment and games clearly distinct from content, never incite a child to buy goods or enter an online contract, and never use prizes, rewards or links to a non-compliant site to keep them engaged.NIST Privacy FrameworkGV.PO-P2NIST Privacy FrameworkCM.AW-P1
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P2Processes to instill organizational privacy values within system/product/service development and operations are established and in place.
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Articles 74 to 77 set the consent rule for a child's data and the ban on sensitive data with its exceptions; Articles 148 to 163 govern health research and health-practice evaluation; Articles 188 to 199 protect children online. None states a log, register or record duty. Article 74 asks the controller to make sure "par tout moyen" (by any means) that the parent gave consent, which is a verification and not a record. Article 157 lets the APDPVP withdraw an authorization where a controller refuses its verifications or refuses to give it copies of documents, a regulator's power the row's own text carries. The row cites no scope clause, so the territorial hook is empty.
- Kind
- None
- As of
What this law does
Article 74 makes processing a child's data lawful on the child's own consent once they turn eighteen, and otherwise only on the express authorization of the holder of parental authority, confirmed by the controller by any means.
Articles 75 and 76 prohibit collecting or processing data revealing racial or ethnic origin, political, philosophical or religious opinions, trade-union membership, biometric or genetic data, or data on health or sex life, unless a listed exception applies: the data subject's own express consent, safeguarding a life the person cannot consent to protect, a non-profit body's processing of its own members' data, data the person made public, establishing or defending a legal claim, preventive medicine, medical diagnosis or care administered by a professional bound by professional secrecy, statistical processing by a competent ministry's statistical service, or health research; the same article separately conditions processing genetic, biometric, or offence and conviction data on the data subject's written, informed, express consent with no risk of discrimination.
Article 77 confines processing of data on offences, convictions and safety measures to public, judicial and public-service bodies acting within their legal remit, and to legal auxiliaries defending the person concerned.
Articles 148 to 151 subject processing personal data for a public-interest research, study or evaluation purpose in the health domain to the APDPVP's authorization, given after the health-research consultative committee opines on the research methodology and the necessity and relevance of the data to it; articles 152 to 163 set the conditions for coding identifying data before transmission by a health professional, publishing results without identifying anyone, and processing health data for evaluating or analyzing care practices and health-system performance.
A dedicated children's-data chapter (articles 188 to 199) treats anyone under eighteen as a child, bars arbitrary or unlawful interference with a child's private life including online, and requires a search engine, website, platform, application or connected or geolocation service to obtain a parent's or guardian's prior consent before collecting a child's personal data; information addressed to a child must be written in terms they can understand, a child's profiling is banned outside an APDPVP-authorized exception for the child's best interest or a public-interest ground, and a contract a child enters through an internet-based service is void on a court challenge where it is prejudicial to them.
An online service aimed at children must build in privacy-protective technical measures such as marking and filtering systems, keep advertising, entertainment and games clearly distinct from content, never incite a child to buy goods or enter an online contract, and never use prizes, rewards or links to non-compliant sites to keep a child engaged.
When LexLint raises it
When your app profile says your app processes biometric data, serves under-18s, makes high-risk automated decisions or processes personal data.
Back to the example · Lint your app
Page updated .