LiberiaData Protection Act of Liberia
An Act for the Collection Processing, Transmission, Storage, Protection, and Use of Personal Information in Liberia (Data Protection Act of Liberia)
In force since .
A comprehensive regime rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Data subject residence, Operator establishment
- Audit expectation
- on_request
What it requires
- This binds any natural or juridical person that collects, processes, transmits, stores or uses personal information of residents of Liberia or the ECOWAS Region, including a personal information controller and a personal information processor.
- Process personal information only on a lawful basis: the data subject's consent, performance of a contract with the data subject, a legal obligation of the controller, protection of vital interests, response to a national emergency or the functions of a public authority, or the legitimate interests of the controller or a third party that the data subject's fundamental rights do not override.NIST Privacy FrameworkCT.PO-P1
- Collect personal data only for specified and legitimate purposes declared before or soon after collection, process it fairly and lawfully, keep it accurate, adequate and not excessive, and retain it only as long as necessary.NIST Privacy FrameworkGV.PO-P1
- Do not process sensitive personal information or privileged information unless an exception in section 13 applies, such as the data subject's consent specific to the purpose.NIST Privacy FrameworkCT.PO-P1
- Before personal information enters your system, or at the next practical opportunity, give the data subject the description, purposes, scope and method of processing, the recipients, your identity and contact details, the storage period and the existence of the rights of access, correction and complaint.NIST Privacy FrameworkCM.AW-P1
- On demand, give a data subject reasonable access to their personal information, its sources and recipients and the manner of processing; correct disputed inaccurate information immediately unless the request is vexatious or unreasonable; and honor a request to suspend, withdraw, block, remove or destroy information that is incomplete, outdated, false, unlawfully obtained or no longer necessary.NIST Privacy FrameworkCT.PO-P3
- On request, give a data subject a copy of personal information processed by electronic means in a structured and commonly used electronic format.NIST Privacy FrameworkCT.DM-P6
- Implement reasonable and appropriate organizational, physical and technical measures to protect personal information against accidental or unlawful destruction, alteration and disclosure and against other unlawful processing, and ensure that third parties processing it for you apply the same measures.NIST Privacy FrameworkPR.DS-P5NIST Privacy FrameworkID.DE-P3
- Promptly notify affected data subjects when sensitive personal information, or other information that may enable identity fraud, is reasonably believed to have been acquired by an unauthorized person and the acquisition is likely to give rise to a real risk of serious harm, describing at least the nature of the breach, the sensitive personal information possibly involved and the measures taken.NIST Privacy FrameworkCM.AW-P7
- Do not conceal a security breach once you know of it and of the obligation to notify.NIST Privacy FrameworkCM.AW-P7
- Remain responsible for personal information transferred to a third party for processing, domestically or internationally, use contractual or other reasonable means to provide a comparable level of protection, and designate an individual accountable for compliance, whose identity is made known to a data subject on request.NIST Privacy FrameworkID.DE-P3NIST Privacy FrameworkGV.PO-P3
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- ID.DE-P3Contracts with data processing ecosystem parties are used to implement appropriate measures designed to meet the objectives of an organization’s privacy program.
- GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such as data uses or retention periods, individuals’ prerogatives with respect to data processing) are established and communicated.
- GV.PO-P3Roles and responsibilities for the workforce are established with respect to privacy.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CT.DM-P6Data are transmitted using standardized formats.
3 more
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
- PR.DS-P5Protections against data leaks are implemented.
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- On what day was the Data Protection Act of Liberia published into handbills under Section 44, which fixes the day it takes effect, and so the day from which the one-year transitory period for existing industries, businesses and offices in Section 41 runs?
- Must an entity or individual outside Liberia and the ECOWAS Region meet all of paragraphs (a), (b) and (c) of Section 7, or only one of them, before the Data Protection Act of Liberia applies to it?
What it makes you log
Who may demand the log
Data subject, Regulator
What the log must hold
Event time, Access record, Data lineage
Logging duty
Section 16(c) gives a data subject reasonable access, on demand, to the contents of the personal information processed, the sources it came from, the names and addresses of its recipients and the manner of processing, and paragraph (7) adds the date the information was last accessed and modified. A controller can answer that only from a record of access and modification. The Act does not use the words log or record for this duty. The Commissioner may carry out verifications of any processing of personal data under Section 8(q)(vi), which names no record either. Section 20(c)(4) separately requires regular monitoring for security breaches and names no record.
- Kind
- Implicit
- As of
- Provision
- Data Protection Act of Liberia, Section 16(c)(7), read with Section 16(c)
- Trigger
- personal_data_processing
What this law does
Liberia's first standalone personal-data statute is formally titled An Act for the Collection, Processing, Transmission, Storage, Protection, and Use of Personal Information in Liberia. It addresses the protection of personal data and privacy as government services, financial transactions, communications, and commercial activities move increasingly online. President Joseph Nyuma Boakai submitted the Act to the Legislature as a bill in June 2025.
The President approved the Act on , as the Ministry of Foreign Affairs' printed copy, printed on , records. Post and Telecommunications Minister Sekou Kromah publicly announced on that the President had signed the Act into law. The Liberia Internet Governance Forum had already reported the same signing in a statement dated .
Section 44 provides that the Act takes effect upon publication into handbills, and section 41 gives existing industries, businesses, and offices one year from the day the Act comes into force to comply. Section 2 gives the Act the short title "Personal Data Protection and Privacy Act of 2024".
The Act applies to the processing of all types of personal information by any natural or juridical person, including a personal information controller and a processor, in respect of residents of Liberia and the ECOWAS Region or beyond. Personal data must be collected for specified and legitimate purposes, processed fairly and lawfully, kept accurate, adequate and not excessive, and retained only as long as necessary.
Processing is permitted only if not otherwise prohibited by law and at least one listed condition exists: the data subject's consent, performance of a contract, compliance with a legal obligation, protection of vital interests, a national emergency or public authority function, or the legitimate interests of the controller or a third party unless overridden by the data subject's fundamental rights.
The processing of sensitive personal information and privileged information is prohibited except in the cases section 13 lists, which include the data subject's consent specific to the purpose.
A data subject is entitled to be informed of the processing, to be furnished stated information before entry into the system, to reasonable access on demand, to dispute and have corrected inaccurate information, to suspend, withdraw or order the blocking, removal or destruction of the information, and to be indemnified for damages. A data subject may obtain from the controller a copy of personal information processed by electronic means in a structured and commonly used format.
A controller must implement reasonable and appropriate organizational, physical and technical measures to protect personal information against accidental or unlawful destruction, alteration and disclosure and against other unlawful processing.
A controller must promptly notify the affected data subjects when sensitive personal information or other information that may enable identity fraud is reasonably believed to have been acquired by an unauthorized person and the acquisition is likely to give rise to a real risk of serious harm, describing at least the nature of the breach, the sensitive personal information possibly involved and the measures taken.
A controller is responsible for personal information under its control or custody, including information transferred to a third party for processing, whether domestically or internationally, and must use contractual or other reasonable means to provide a comparable level of protection while the information is processed by the third party. The Independent Information Commissioner administers the Act and may authorize trans-border transfers of personal data.
The Commissioner may issue cease and desist orders and impose a temporary or permanent ban on the processing of personal information. The Commissioner may also impose administrative and financial sanctions on data controllers. Unauthorized processing of personal information is penalized by imprisonment of one year and a fine of not less than L$25,000.
Concealing a security breach after learning of it and of the obligation to notify is penalized by imprisonment of two years and a fine of L$15,000 to L$30,000.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .