GambiaPersonal Data Protection and Privacy Act, 2025, rights of the data subject
Personal Data Protection and Privacy Act, 2025, rights of the data subject
A data subject rights rule binding public and private bodies.
- Obligation class
- Disclosure, Data subject rights
- Audit expectation
- none
What it requires
- Give a data subject your identity, the purposes of the processing, the recipients of the data and your legal basis, at the time you collect their personal data or within a reasonable period where you obtained it indirectly.NIST Privacy FrameworkCM.AW-P1
- On request, confirm whether you are processing a person's personal data, give them a copy of it free of charge, and give them the details of the processing activities.NIST Privacy FrameworkCT.DM-P1
- Correct inaccurate or incomplete personal data on demand, and update your records without undue delay.NIST Privacy FrameworkCT.DM-P3
- Delete personal data on request where it is no longer necessary for the purpose you collected it for, where consent is withdrawn, or where the processing is unlawful.NIST Privacy FrameworkCT.DM-P4
- Store personal data without processing it further while its accuracy is contested or another ground for restriction applies.NIST Privacy FrameworkCT.PO-P3
- Cease processing personal data for direct marketing immediately upon request, and weigh any other objection made on grounds relating to the data subject's particular circumstances.NIST Privacy FrameworkCT.PO-P3
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CT.DM-P1Data elements can be accessed for review.
- CT.DM-P3Data elements can be accessed for alteration.
- CT.DM-P4Data elements can be accessed for deletion.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Sections 9 to 15 set what a controller must tell and give a data subject and when: confirmation, a copy and the listed information within one month (section 9), rectification, erasure and restriction (section 10), objection (section 11), the right not to be subject to a solely automated decision (section 12), assistance from the Commission (section 13), representation by a not-for-profit body (section 14) and remedy and compensation (section 15). Section 9(6) puts on the controller the burden of proving that a request is manifestly excessive or repetitive, and section 9(4) requires reasons for a delay; these are conditions on refusing or delaying a request and name no log, register or record. No audit and no party who may demand a record is named. Section 3, which carries the territorial clause, is not part of this row, so the hook is empty. Section numbers follow the National Assembly's published text of the Data Protection and Privacy Bill, 2024.
- Kind
- None
- As of
What this law does
A controller must provide a data subject with comprehensive details of its identity, the purposes of the processing, the recipients of the data and the legal basis for the processing, at the time of collection or within a reasonable period where the data was obtained indirectly. A data subject may request confirmation of whether their personal data is being processed and obtain a copy of that data free of charge, along with specific details about the processing activities.
A data subject may demand the correction of inaccurate or incomplete personal data, which obliges the controller to update its records without undue delay. A data subject may request deletion of personal data that is no longer necessary for the original purpose, where consent is withdrawn, or where the processing is unlawful.
A data subject may require processing to be restricted in specific circumstances, such as where the accuracy of the data is contested, so that the data is stored but not further processed until the issue is resolved. A data subject may object to processing at any time based on their particular circumstances, and has an absolute right to object to processing for direct marketing purposes, which the controller must cease immediately upon request.
The Gambia has enacted the Personal Data Protection and Privacy Act, 2025. The Information Commission and the Ministry of Information conducted community sensitisation sessions on the newly enacted Act in November 2025. The National Assembly's bill tracker lists the Data Protection and Privacy Bill, 2024 at the stage Assented.
When LexLint raises it
When your app profile says your app sends automated outreach or processes personal data.
Back to the example · Lint your app
Page updated .