GambiaPersonal Data Protection and Privacy Act, 2025, sensitive personal data and children's data
Personal Data Protection and Privacy Act, 2025, sensitive personal data and children's data
A sensitive categories rule binding public and private bodies.
- Obligation class
- Consent, Biometric, Design code
- Audit expectation
- none
What it requires
- Do not process genetic or biometric data, or data revealing racial origin, political opinions or health status, unless you have both a lawful basis and one of the Act's listed conditions, such as the data subject's explicit consent.NIST Privacy FrameworkCT.PO-P1
- Obtain parental or guardian consent before processing the personal data of a person under the age of 18, and put that child's best interests and privacy first.NIST Privacy FrameworkCT.PO-P1
- Apply specific safeguards to any marketing or profiling directed at children, and put anything addressed to a child in clear, plain language they can easily understand.NIST Privacy FrameworkID.RA-P5NIST Privacy FrameworkCM.AW-P1
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- ID.RA-P5Risk responses are identified, prioritized, and implemented.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Section 6 allows processing of special categories of data only where additional safeguards are in place and one of nine listed conditions applies, and section 7 requires respect for a child's privacy and best interest, specific safeguards for marketing, profiling and services offered directly to children, plain-language information, and parental consent or another listed basis. Neither section names a log, register or record, and neither names an audit or a party who may demand one. Section 3, which carries the territorial clause, is not part of this row, so the hook is empty. Section numbers follow the National Assembly's published text of the Data Protection and Privacy Bill, 2024.
- Kind
- None
- As of
What this law does
The Act imposes a stricter regime for the processing of sensitive personal data, which includes genetic and biometric data and data revealing racial origin, political opinions or health status. Processing such data is generally prohibited unless the controller identifies a lawful basis and also satisfies one of the specific conditions the Act sets out.
Those conditions include explicit consent, obligations in the field of employment and social security, vital interests where the subject is physically incapable of consenting, and reasons of substantial public interest such as public health or national security. A child is a person under the age of 18, and a controller processing a child's data must prioritise the child's best interests and privacy.
Specific safeguards are required for marketing or profiling directed at children, the lawful processing of a child's data generally requires parental or guardian consent, and all information directed at children must be in clear, plain language that they can easily understand. The Gambia has enacted the Personal Data Protection and Privacy Act, 2025. The Information Commission and the Ministry of Information conducted community sensitisation sessions on the newly enacted Act in November 2025. The National Assembly's bill tracker lists the Data Protection and Privacy Bill, 2024 at the stage Assented.
When LexLint raises it
When your app profile says your app processes biometric data, serves under-18s, sends automated outreach, makes high-risk automated decisions or processes personal data.
Back to the example · Lint your app
Page updated .