GambiaPersonal Data Protection and Privacy Act, 2025, transfer of personal data outside The Gambia
Personal Data Protection and Privacy Act, 2025, transfer of personal data outside The Gambia
A cross border transfer rule binding public and private bodies.
- Obligation class
- Transfer, Governance
- Audit expectation
- on_request
What it requires
- Before transferring personal data out of The Gambia, confirm that the receiving country or international organisation has a law providing an appropriate level of protection, or put appropriate safeguards in place through an ad hoc or standardised instrument the Information Commission has adopted.NIST Privacy FrameworkCT.PO-P2
- Assess the level of protection yourself, taking into account the nature of the data, the purpose of the transfer, and the recipient country's legal regime.NIST Privacy FrameworkID.DE-P2
- Document the assessment of the safeguards or criteria that justify each transfer out of The Gambia.NIST Privacy FrameworkID.DE-P2
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- ID.DE-P2Data processing ecosystem parties (e.g., service providers, customers, partners, product manufacturers, application developers) are identified, prioritized, and assessed using a privacy risk assessment process.
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Who may demand the log
Regulator
What the log must hold
Decision basis, Data lineage
Logging duty
Section 37(2) has the controller assess the level of protection in the receiving country or international organisation, weighing the nature of the data, the purpose and duration of the transfer, the data protection laws in force there and the recipients. Section 37(4) requires the controller or processor to document that assessment of safeguards or criteria. Section 37(5) requires the controller, on request, to give the Commission all relevant information on the transfers, and lets the Commission ask the controller to demonstrate that the safeguards are effective. The text states no period for keeping the documentation. Section 3, which carries the territorial clause, is not part of this row, so the hook is empty. Section numbers follow the National Assembly's published text of the Data Protection and Privacy Bill, 2024.
- Kind
- Explicit
- As of
- Provision
- Section 37(4) and (5) (the assessment behind a cross-border transfer is documented and produced to the Commission on request)
- Trigger
- personal_data_processing
What this law does
The Act regulates the transfer of personal data to countries or international organisations outside The Gambia so that the level of protection it guarantees is not undermined.
The primary mechanism for transfer is adequacy, where the receiving country or international organisation has a law that provides an appropriate level of protection, and in the absence of such a law transfers may proceed based on appropriate safeguards established through ad hoc or standardised instruments adopted by the Information Commission.
The controller is responsible for assessing whether an appropriate level of protection exists, taking into account the nature of the data, the purpose of the transfer, and the recipient country's legal regime. The controller or processor must document the assessment of the appropriate safeguards or criteria that justify the transfer, and the Commission has a supervisory role in assessing whether the transfer criteria are met.
The Gambia has enacted the Personal Data Protection and Privacy Act, 2025. The Information Commission and the Ministry of Information conducted community sensitisation sessions on the newly enacted Act in November 2025. The National Assembly's bill tracker lists the Data Protection and Privacy Bill, 2024 at the stage Assented.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .