GambiaPersonal Data Protection and Privacy Act, 2025, automated decision-making
Personal Data Protection and Privacy Act, 2025, automated decision-making
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights
- Audit expectation
- none
What it requires
- Do not base a decision that produces legal effects for a person, or otherwise significantly affects them, solely on automated processing, including profiling.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 3.5Processes for human oversight are defined, assessed, and documented in accordance with organizational policies from the GOVERN function.
- NIST Privacy Framework
- CT.DM-P10Stakeholder privacy preferences are included in algorithmic design objectives and outputs are evaluated against these preferences.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What record it asks for
Logging duty
Section 12 gives the data subject the right not to be subject to a decision that significantly affects them and rests solely on automated processing, without their views being taken into account. It excepts decisions authorised by law, necessary for a contract or based on consent, and requires suitable safeguards for the first and third. It names no log, register or record of the decision, and names no audit and no party who may demand one. Section 12(4) sends decisions based on special categories of data to sections 28 and 31, the design and impact-assessment duties, which sit with the row on controller obligations and are not borrowed here. Section 3, which carries the territorial clause, is not part of this row, so the hook is empty. Section numbers follow the National Assembly's published text of the Data Protection and Privacy Bill, 2024.
- Kind
- None
- As of
What this law does
A data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or significantly affects them. The Gambia has enacted the Personal Data Protection and Privacy Act, 2025. The Information Commission and the Ministry of Information conducted community sensitisation sessions on the newly enacted Act in November 2025. The National Assembly's bill tracker lists the Data Protection and Privacy Bill, 2024 at the stage Assented.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions.
Back to the example · Lint your app
Page updated .