GambiaPersonal Data Protection and Privacy Act, 2025, personal data breach notification
Personal Data Protection and Privacy Act, 2025, breach notification
A breach notification rule binding public and private bodies.
- Criminal exposure
- Yes
- Criminal exposure note
- Concealment of a security breach is an offence carrying a potential two-year prison term.
- Obligation class
- Breach notice, Reporting
- Audit expectation
- on_request
What it requires
- Notify the Information Commission of a personal data breach within 72 hours of becoming aware of the breach.
- Notify each affected data subject of a personal data breach without undue delay where the breach carries a high risk to their rights.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
- NIST CSF 2.0
- RS.CO-02Internal and external stakeholders are notified of incidents
- FINOS AIGF
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Who may demand the log
Regulator
Logging duty
Section 32(5) requires the controller to document any personal data breach, with all relevant facts, its effects and the remedial actions taken, so that the Commission can verify compliance. Section 32(1) to (4) require notification to the Commission within 72 hours, with reasons if it is late, and the content of the notification, and section 33 requires notification to the data subject where the risk is high; those are reports sent on an event and are not coded as audit. Section 21 makes it an offence to conceal a breach to prevent disclosure to the Commission. The text states no period for keeping the documentation. Section 3, which carries the territorial clause, is not part of this row, so the hook is empty. Section numbers follow the National Assembly's published text of the Data Protection and Privacy Bill, 2024.
- Kind
- Explicit
- As of
- Provision
- Section 32(5) (the controller documents any personal data breach, including its facts, effects and remedial actions)
- Trigger
- security_incident
What this law does
The Act sets a strict timeline for reporting breaches. A controller must notify the Information Commission within 72 hours of becoming aware of a breach. A controller must also notify affected data subjects without undue delay if there is a high risk to their rights. Concealment of a security breach is a criminal offence carrying a potential two-year prison term. The Gambia has enacted the Personal Data Protection and Privacy Act, 2025.
The Information Commission and the Ministry of Information conducted community sensitisation sessions on the newly enacted Act in November 2025. The National Assembly's bill tracker lists the Data Protection and Privacy Bill, 2024 at the stage Assented.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .