GambiaPersonal Data Protection and Privacy Act, 2025, the Information Commission, offences and penalties
Personal Data Protection and Privacy Act, 2025, offences, penalties and the Information Commission
An enforcement supervision rule binding public and private bodies.
- Obligation class
- Prohibition, Governance
- Audit expectation
- on_request
What it requires
- Do not sell personal data, and do not process personal data unlawfully for financial gain or to cause harm: both are criminal offences under the Act.NIST Privacy FrameworkCT.PO-P1
- Expect the Information Commission to investigate complaints about your processing, to enter and search your premises under a warrant, to impose administrative sanctions and monetary fines, and to issue a binding enforcement notice.
- Do not obstruct an investigation by the Information Commission, which carries up to seven years of imprisonment.NIST Privacy FrameworkGV.PO-P5
- Compensate a data subject for material or non-material damage they suffer from an infringement of the Act, which they, or a non-profit organisation they authorise, may pursue as a judicial remedy.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Unlawful processing of personal data for financial gain or to cause harm attracts a prison term of up to three years or a fine of not less than 500,000 Dalasis. The sale of personal data carries up to five years imprisonment for an individual, while a corporate body faces a fine of not less than 1,000,000 Dalasis or 5% of its gross income. An aggravated offence such as unlawfully selling data can result in imprisonment of up to 10 years and a fine of not less than 10,000,000 Dalasis for a corporation. Concealment of a security breach carries a potential two-year prison term, and obstruction of the Commission's investigation carries up to seven years of imprisonment.
Who enforces it
Enforcement body
Information Commission
Settledness
- As of
- Open questions
- What ceiling or method of calculation governs the "financial penalty, calculated by the Commission" that the Information Commission may impose on a controller or processor?
- Which law of The Gambia sets the court and the measure of compensation for a data subject who "suffers material or non-material damage", given that the right to compensation is "in accordance with the laws of The Gambia"?
What it makes you log
Who may demand the log
Regulator
Logging duty
Sections 16 to 24 set the offences and sections 38 to 42 the Commission's functions, powers and penalties. None imposes a duty on a controller or processor to make or keep a log or record. Section 40(1)(q) has the Commission keep internal records of infringements, which is the regulator's own register. Sections 20 and 23 make it an offence to alter, destroy or conceal data or documents to prevent disclosure to a data subject or to the Commission, which bars spoliation and sets no retention period. Section 41(a) lets the Commission request information, including records, from controllers and processors. Section 3, which carries the territorial clause, is not part of this row, so the hook is empty. Section numbers follow the National Assembly's published text of the Data Protection and Privacy Bill, 2024.
- Kind
- None
- As of
What this law does
Rather than creating a new agency from scratch, the Act designates the Information Commission, established under the Access to Information Act, 2021, as the regulatory authority. The Commission is granted independence and extensive powers, including the authority to investigate complaints and conduct separate inquiries, to enter and search premises with warrants, to impose administrative sanctions and monetary fines, and to issue binding enforcement notices.
Its administrative sanctions include corrective warnings, enforcement notices, bans on processing, and financial penalties calculated by the Commission. Unlawful processing of data for financial gain or to cause harm attracts a prison term of up to three years or a fine of not less than 500,000 Dalasis. The sale of personal data carries a penalty of up to five years imprisonment for individuals, while corporate bodies face fines of not less than 1,000,000 Dalasis or 5% of their gross income.
Aggravated offences, such as unlawfully selling data, can result in imprisonment of up to 10 years and fines of not less than 10,000,000 Dalasis for corporations. Obstruction of the Commission's investigation carries up to seven years of imprisonment.
A data subject has the right to lodge complaints and the right to compensation for material or non-material damage suffered as a result of an infringement of the Act, and may authorise a non-profit organisation to lodge complaints or pursue judicial remedies on their behalf. The Gambia has enacted the Personal Data Protection and Privacy Act, 2025. The Information Commission and the Ministry of Information conducted community sensitisation sessions on the newly enacted Act in November 2025. The National Assembly's bill tracker lists the Data Protection and Privacy Bill, 2024 at the stage Assented.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .