GambiaPersonal Data Protection and Privacy Act, 2025
A comprehensive regime rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, User location
- Obligation class
- Consent, Security, DPIA, Governance
- Audit expectation
- on_request
What it requires
- Establish one of the Act's seven lawful bases before processing personal data, whether you are established in The Gambia or process the data of individuals in the country from outside it.NIST Privacy FrameworkCT.PO-P1
- Collect personal data only for explicit and legitimate purposes, keep it adequate and relevant to those purposes, keep it accurate and up to date, and process it securely.NIST Privacy FrameworkGV.PO-P1
- Carry out a compatibility assessment before putting personal data to a new purpose, weighing the relationship between the purposes, the context of collection, the nature of the data, the consequences for the data subject and the safeguards in place.NIST Privacy FrameworkGV.PO-P1
- Use only a processor that provides sufficient guarantees of compliance, govern the engagement by a contract setting out the subject matter, duration, nature and purpose of the processing, and do not engage a sub-processor without the controller's prior written authorisation.NIST Privacy FrameworkID.DE-P2NIST Privacy FrameworkID.DE-P3
- Where you determine the purposes and means of processing jointly with another controller, specify each party's compliance responsibilities.NIST Privacy FrameworkGV.PO-P4
- Design your technical and organisational measures to implement the data protection principles, and ensure that by default only the personal data necessary for each specific purpose is processed.NIST Privacy FrameworkGV.PO-P2
- Maintain a written record of your processing activities, as a controller and as a processor alike.NIST Privacy FrameworkID.IM-P4
- Carry out a data protection impact assessment before high-risk processing such as profiling or large-scale surveillance.NIST Privacy FrameworkID.RA-P4
- Designate a data protection officer if you are a public authority, or if you engage in large-scale monitoring or large-scale processing of sensitive data.NIST Privacy FrameworkGV.PO-P3
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- ID.IM-P4Data actions of the systems/products/services are inventoried.
- ID.RA-P4Problematic data actions, likelihoods, and impacts are used to determine and prioritize risk.
- ID.DE-P2Data processing ecosystem parties (e.g., service providers, customers, partners, product manufacturers, application developers) are identified, prioritized, and assessed using a privacy risk assessment process.
- ID.DE-P3Contracts with data processing ecosystem parties are used to implement appropriate measures designed to meet the objectives of an organization’s privacy program.
- GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such as data uses or retention periods, individuals’ prerogatives with respect to data processing) are established and communicated.
- GV.PO-P2Processes to instill organizational privacy values within system/product/service development and operations are established and in place.
3 more
- GV.PO-P3Roles and responsibilities for the workforce are established with respect to privacy.
- GV.PO-P4Privacy roles and responsibilities are coordinated and aligned with third-party stakeholders (e.g., service providers, customers, partners).
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- NIST CSF 2.0
- GV.SC-05Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Which processing operations will the list that section 31(4) directs the Commission to "establish and publish" name as requiring a data protection impact assessment, beyond the three cases in section 31(2)?
- At what size does a controller's monitoring of data subjects count as "on a large scale" for the duty in section 34(1)(b) to designate a data protection officer, where its core activities involve "regular and systematic monitoring"?
What it makes you log
Who may demand the log
Regulator
What the log must hold
Actor identity, Data lineage
Logging duty
Section 30 requires controllers and processors to keep a written record of processing activities, which may be in electronic form. The record holds the name and contact details of the controller, any joint controller and the data protection officer, the purposes of the processing, the categories of data subjects and personal data, the categories of recipients including those in third countries or international organisations, the intended retention period, and a general description of the technical and organisational security measures. Section 35(2) obliges the controller and processor to give the Commission, on its request, the information and records necessary for monitoring processing operations. Section 4(11) makes the controller responsible for, and able to demonstrate, compliance with the processing principles, and section 8(1) requires the controller to provide evidence of consent where consent is the basis; neither names a form of record. The text states no period for keeping the record; section 30(2)(e) asks the record to state the intended retention period of the personal data, and section 4(8) has personal data erased once its purpose is achieved, both concerning the data and not the record. Section 31 requires an impact assessment before high-risk processing, containing at least a description of the processing, its necessity and proportionality, its likely impact and the measures envisaged. Section numbers follow the National Assembly's published text of the Data Protection and Privacy Bill, 2024.
- Kind
- Explicit
- As of
- Provision
- Section 30(1) and (2) (a written record of processing activities), with section 35(2)
- Trigger
- personal_data_processing
What this law does
The Act applies to the processing of personal data by both automated and non-automated means where the data forms part of a filing system, and it asserts extraterritorial jurisdiction over a controller outside The Gambia whose processing relates to individuals within the country. Purely personal or household activities and anonymous data are carved out of that scope.
Personal data must be processed fairly, transparently and lawfully, collected only for explicit and legitimate purposes, kept adequate and relevant to the purpose, kept accurate and up to date, and processed securely so that its integrity and confidentiality are maintained.
The Act establishes seven lawful bases for processing: consent, contract performance, legal obligation, vital interests, public task, legitimate interest, and processing for archiving, public interest, scientific or historical research or statistical purposes under appropriate safeguards.
Secondary use of personal data for a new purpose is permitted only after a compatibility assessment weighing the relationship between the purposes, the context of collection, the nature of the data, the consequences for the data subject and the safeguards in place. Joint controllers must clearly specify their respective compliance responsibilities.
A controller may use only a processor that provides sufficient guarantees of compliance, the relationship must be governed by a contract setting out the subject matter, duration, nature and purpose of the processing, and a processor may not engage a sub-processor without the controller's prior written authorisation.
Technical and organisational measures must be designed to implement the data protection principles and to ensure that, by default, only the personal data necessary for each specific purpose is processed. Both controllers and processors must maintain a written record of processing activities.
A prior data protection impact assessment is required for high-risk processing such as profiling or large-scale surveillance, and designation of a data protection officer is mandatory for public authorities and for organisations engaged in large-scale monitoring or processing of sensitive data. The Gambia has enacted the Personal Data Protection and Privacy Act, 2025.
The Information Commission and the Ministry of Information conducted community sensitisation sessions on the newly enacted Act in November 2025. The National Assembly's bill tracker lists the Data Protection and Privacy Bill, 2024 at the stage Assented.
When LexLint raises it
When your app profile says your app trains models, sends automated outreach, processes biometric data, makes high-risk automated decisions or processes personal data.
Back to the example · Lint your app
Page updated .