Personal Data Protection and Privacy Act, 2025

The Act applies to the processing of personal data by both automated and non-automated means where the data forms part of a filing system, and it asserts extraterritorial jurisdiction over a controller outside The Gambia whose processing relates to individuals within the country. Purely personal or household activities and anonymous data are carved out of that scope.

Personal data must be processed fairly, transparently and lawfully, collected only for explicit and legitimate purposes, kept adequate and relevant to the purpose, kept accurate and up to date, and processed securely so that its integrity and confidentiality are maintained.

The Act establishes seven lawful bases for processing: consent, contract performance, legal obligation, vital interests, public task, legitimate interest, and processing for archiving, public interest, scientific or historical research or statistical purposes under appropriate safeguards.

Secondary use of personal data for a new purpose is permitted only after a compatibility assessment weighing the relationship between the purposes, the context of collection, the nature of the data, the consequences for the data subject and the safeguards in place. Joint controllers must clearly specify their respective compliance responsibilities.

A controller may use only a processor that provides sufficient guarantees of compliance, the relationship must be governed by a contract setting out the subject matter, duration, nature and purpose of the processing, and a processor may not engage a sub-processor without the controller's prior written authorisation.

Technical and organisational measures must be designed to implement the data protection principles and to ensure that, by default, only the personal data necessary for each specific purpose is processed. Both controllers and processors must maintain a written record of processing activities.

A prior data protection impact assessment is required for high-risk processing such as profiling or large-scale surveillance, and designation of a data protection officer is mandatory for public authorities and for organisations engaged in large-scale monitoring or processing of sensitive data. The Gambia has enacted the Personal Data Protection and Privacy Act, 2025.

The Information Commission and the Ministry of Information conducted community sensitisation sessions on the newly enacted Act in November 2025. The review records the Act as enacted and names no date on which it comes into operation, so the day its duties begin to bind is not established.