Gabon

Ordonnance n°0011/PR/2026 bans outright, whatever their place of creation, four categories of AI-generated content circulated on a social network or digital platform in Gabon: a realistic deepfake depicting an identifiable person in a sexual situation without their express consent, a deepfake of a public or private figure attributing false statements or conduct to them capable of causing serious harm to public order, national security, or personal dignity, a representation of a sexual situation involving a minor by any technical method, and an imitation of a Gabonese state institution's visual or audio identity for disinformation.

Content falling into these categories can be referred immediately to the emergency-relief judge, whose territorial competence is both domestic and extraterritorial and who may order a temporary suspension of an account or content, a targeted de-referencing, publication of a correction, or the forced insertion of an origin marking on the AI-generated content.

An identifiable person depicted without consent in AI-generated content published on a social network or platform separately has a right to report it and have the editor or host remove it within twenty-four hours of the report.

Ordonnance n°0011/PR/2026 requires every social-network or digital-platform editor, within twelve months of the ordinance's publication (by April 2027), to deploy tools that automatically detect AI-generated content published or shared on its service according to technical standards set by other regulations, to affix a visible, clear, and permanent label to any content identified as generated or substantially modified by an AI system, accessible to the user without any further action on their part, and to preserve and hand over to the Haute Autorité de la Communication, within eight days, the origin metadata of AI-generated content that is the subject of a judicial or administrative investigation.

An emergency-relief judge may also order the forced insertion of an origin marking on AI-generated content as a provisional measure.

Article 142 requires the controller, on a personal-data breach, to inform the APDPVP without delay, giving the breach's nature, the categories and approximate number of data subjects and records concerned where possible, the data protection officer's or another contact point's details, the likely consequences, and the measures taken or proposed to remedy it; article 143 requires supporting evidence of the breach to accompany that notice.

The law states no numeric deadline for this notice: it runs 'sans délai', without delay, rather than within a stated number of hours or days. Article 144 requires a processor to notify the controller of any breach without delay as soon as it becomes aware of it.

Article 145 requires the controller, where a breach is likely to create a high risk to a person's rights and freedoms, to inform that person as soon as possible, and article 146 requires the communication to describe the breach in clear and simple terms and to carry at least the information article 142 lists for the Authority.

Article 147 excuses that communication to the person only where the controller had already applied protective measures rendering the affected data unintelligible, where later measures mean the high risk is no longer likely to materialize, or where it would take disproportionate effort, in which case a public communication of equal effect substitutes for it; the APDPVP can still compel direct communication after weighing the breach's gravity.

Article 147 also requires every controller to keep an up-to-date register of personal-data breaches, their circumstances, their impact and the remedial measures taken, available to the APDPVP.

Loi n°025/2023 wholly modifies and completes loi n°001/2011, setting Gabon's general rules for the collection, processing and transfer of personal data by any public or private controller (articles 2 to 4), subject to the household-activity and transit-copy exclusions of article 5.

Processing must be fair and lawful, collected for determined and legitimate purposes, and kept accurate and no longer than those purposes need (article 70), on a lawful basis such as consent, a legal obligation, a public-service mission, contract performance, or a legitimate interest that does not override the data subject's own rights (article 71); where consent is relied on it must be demonstrable, presented clearly and separately from other terms, and, for an electronic transaction, taken by an unambiguous act rather than a pre-checked box or the general terms of sale (articles 72 to 73).

An automated processing activity is declared to the APDPVP before it starts, unless it falls under a simplified or exempt category, while processing touching the categories articles 74 and 81 to 83 list instead needs the APDPVP's prior authorization or a ministerial or Council-of-Ministers decree (articles 78 to 90); the Authority keeps a public, open-format register of every declared or authorized processing activity (article 88).

Processing is confidential, everyone who handles the data under the controller's authority signs a written confidentiality undertaking, and a processor owes the controller the same security and confidentiality guarantees by contract (articles 111 to 112).

The controller and processor must implement risk-adapted technical and organizational security measures, including pseudonymization and encryption, and regularly test their effectiveness (article 113), preserve the data's continuity and keep it no longer than its purpose needs (article 118), and keep a written or electronic register of processing activities naming the controller, purposes, data categories, recipients, transfers and retention periods, produced to the APDPVP on request; an organization of fewer than ten employees is exempt from that register unless the processing carries a risk to rights and freedoms, is not occasional, or touches sensitive or criminal-offence data (articles 119 to 123).

A controller or processor designates a data protection officer, notified to the APDPVP, where it is a public authority or body, carries out large-scale systematic monitoring, or processes sensitive or criminal-offence data at scale, and gives that officer the office, resources and independence the law describes (articles 124 to 141).

Processing carried out solely for literary or artistic expression, or for the professional practice of journalism observing that profession's ethical rules, falls outside the law, provided a press or broadcast body designates its own data-protection correspondent in place of the ordinary declaration (articles 164 to 167).

A further chapter conditions the deployment of an artificial-intelligence system, a digital-identity or biometric-identification service such as facial recognition, a drone or other connected object, an electronic-signature service, or a national or sectoral identifier system, on filing the declaration or notice a norme or decree sets for it with the APDPVP (articles 175 to 187).

Every controller must conform from the law's publication (article 219), and the Authority funds itself through a statutory levy on controllers and processors and issues its own code of conduct by sector (articles 216 to 221).

Article 171 conditions any transfer of personal data to another State on the APDPVP's prior authorization, which the Authority grants only once it is satisfied the destination State assures a sufficient level of protection, judged by that State's rules, its security measures, and the processing's own purpose, duration, nature, origin and destination; the APDPVP publishes the list of States it has found to offer a sufficient level of protection.

Article 173 lets a controller transfer to a State that does not meet article 171's standard only where the data subject has expressly consented to that specific transfer and it is necessary to safeguard the person's life or the public interest, to establish, exercise or defend a legal claim, to consult a public register, or to perform or negotiate a contract with or for the person's benefit, or otherwise by a decision of the APDPVP or a decree finding the processing offers a sufficient level of protection through means such as contractual clauses or binding internal rules.

Article 174 has the APDPVP issue a receipt barring a transfer once it finds the destination State's protection insufficient, informing officials and the public without delay, and enjoining a controller to suspend or cancel a transfer a pending declaration reveals; it lifts the suspension once it finds the State's protection now sufficient.

Articles 168 to 170 separately condition on the APDPVP's authorization any interconnection of information systems belonging to different public-service bodies pursuing different public interests, or to different private parties pursuing different main purposes, and record every interconnection request and authorization in the public register of processing activities.

Chapter III, section 1 (articles 43 to 69) gives a data subject the right of access to the data a controller holds on them, the right to rectification and to erasure, the right to have processing restricted, the right to receive their data in a portable format, the right to object to processing, and the right, at article 66, to oppose a decision based solely on automated processing, including profiling, that concerns them.

Section 2's transparency paragraph (articles 91 to 110) requires the controller to inform the person, at collection, of the controller's and any data protection officer's identity and contact details, the purpose and legal basis of processing, any legitimate interest relied on, recipients, any transfer abroad, the retention period or the criteria for it, the person's rights including withdrawal of consent, the right to complain to the APDPVP, and the existence and logic of any automated decision-making or profiling concerning them (article 98); where the data were not collected from the person, the same categories of information are owed, plus the data's origin and whether it came from a publicly accessible source, within one month or by the time of first contacting the person or first disclosing the data, whichever comes first (articles 100 to 101).

A controller must act on an access, rectification, erasure, restriction, portability or objection request within one month of receiving it, extendable by two months for complex or numerous requests provided the person is told of the extension and its reasons within the first month; declining to act requires telling the person why within one month and of their right to complain to the APDPVP or go to court (articles 93 to 94).

Information is provided free of charge, except that a manifestly unfounded or excessive request, particularly a repetitive one, lets the controller charge a reasonable fee or refuse, with the burden of showing that on the controller (article 95).

Article 104 requires anyone accessing or storing information on a subscriber's or user's terminal equipment, such as through a cookie, to tell them the purpose and how to object, and to proceed only once they have consented through their connection settings or another device they control, except where the access is strictly necessary to provide an electronic communication service they expressly requested.

Article 200 gives any person a non-jurisdictional and a jurisdictional recourse for a breach or violation touching their personal data, but bars the APDPVP itself from awarding compensation, which only the ordinary courts can rule on.

Articles 201 and 202 let the APDPVP's members and sworn, authorized agents, accompanied by judicial police officers with the public prosecutor informed in advance, access a controller's professional premises used for processing, demand documents, and access programs and data for control purposes, with a court order required over the premises holder's opposition.

Sanctions escalate from a warning, to a formal notice to end a breach within a set period, to a financial penalty the Authority can make public (articles 203 to 205): a first breach is capped at 98,400,000 FCFA and, on repetition, at 300,000,000 FCFA or 5% of a company's last closed financial year's turnover up to 196,000,000 FCFA, alongside a provisional suspension of collecting or processing data that becomes definitive after three months.

A controller that already holds a declaration receipt or authorization and breaches the law faces, after formal notice, suspension of that receipt or authorization for up to two months, then its definitive withdrawal, and a fine of 1,000,000 to 100,000,000 FCFA; a controller that never filed at all is a de facto controller facing the same fine alongside a formal notice to regularize (articles 206 to 207).

Article 208 lets the APDPVP order, without the notice-and-cure process, the interruption of a processing operation, the locking of data, or a temporary ban of up to three months, or a definitive ban, wherever it finds a processing operation violates rights and freedoms.

Sanctions and APDPVP decisions are appealable to the Conseil d'Etat (article 210), and any person may sue a controller or processor in the competent courts after first bringing the matter to the APDPVP, including through a nongovernmental organization or association working in data protection that the person mandates to represent them (article 211).

Criminal offences arising from a breach of the law are punished under the Penal Code (article 212), and obstructing the APDPVP's own action, by opposing its members or agents or refusing or concealing documents useful to their mission, carries six months' to a year's imprisonment and a fine of 1,000,000 to 10,000,000 FCFA, doubled on repetition (article 213).

Article 74 makes processing a child's data lawful on the child's own consent once they turn eighteen, and otherwise only on the express authorization of the holder of parental authority, confirmed by the controller by any means.

Articles 75 and 76 prohibit collecting or processing data revealing racial or ethnic origin, political, philosophical or religious opinions, trade-union membership, biometric or genetic data, or data on health or sex life, unless a listed exception applies: the data subject's own express consent, safeguarding a life the person cannot consent to protect, a non-profit body's processing of its own members' data, data the person made public, establishing or defending a legal claim, preventive medicine, medical diagnosis or care administered by a professional bound by professional secrecy, statistical processing by a competent ministry's statistical service, or health research; the same article separately conditions processing genetic, biometric, or offence and conviction data on the data subject's written, informed, express consent with no risk of discrimination.

Article 77 confines processing of data on offences, convictions and safety measures to public, judicial and public-service bodies acting within their legal remit, and to legal auxiliaries defending the person concerned.

Articles 148 to 151 subject processing personal data for a public-interest research, study or evaluation purpose in the health domain to the APDPVP's authorization, given after the health-research consultative committee opines on the research methodology and the necessity and relevance of the data to it; articles 152 to 163 set the conditions for coding identifying data before transmission by a health professional, publishing results without identifying anyone, and processing health data for evaluating or analyzing care practices and health-system performance.

A dedicated children's-data chapter (articles 188 to 199) treats anyone under eighteen as a child, bars arbitrary or unlawful interference with a child's private life including online, and requires a search engine, website, platform, application or connected or geolocation service to obtain a parent's or guardian's prior consent before collecting a child's personal data; information addressed to a child must be written in terms they can understand, a child's profiling is banned outside an APDPVP-authorized exception for the child's best interest or a public-interest ground, and a contract a child enters through an internet-based service is void on a court challenge where it is prejudicial to them.

An online service aimed at children must build in privacy-protective technical measures such as marking and filtering systems, keep advertising, entertainment and games clearly distinct from content, never incite a child to buy goods or enter an online contract, and never use prizes, rewards or links to non-compliant sites to keep a child engaged.

Loi n°027/2023 punishes fraudulently accessing all or part of a computer system, including exceeding an authorized access, with up to ten years' imprisonment and a fine of up to 100,000,000 FCFA or one of these penalties; fraudulently remaining in a system or hindering its operation each carry up to five years and up to 50,000,000 FCFA or either penalty; and fraudulently introducing, altering, deleting, or extracting data, or knowingly using data obtained through any of these offences, each carry up to ten years and up to 100,000,000 FCFA or either penalty.

An offence against a State information system or critical infrastructure, or an offence committed in an organized group, is punished more heavily still: up to twenty-five years' criminal detention and a fine of up to 500,000,000 FCFA. A legal person additionally faces dissolution, a temporary or permanent bar on operating, closure of an establishment, or exclusion from public tenders, where it diverted its purpose to commit the offence.

The law replaced ordonnance n°15/PR/2018 du 23 février 2018 on the same subject, and gave every person and entity it reaches six months from its entry into force to come into compliance.

Loi n°1/87 protects a collection of literary or artistic works, such as an encyclopedia or anthology, as an original work only where the choice or arrangement of its contents constitutes an intellectual creation; the text does not name a database specifically, so an unoriginal, purely factual database or compilation of data is not itself protected against reproduction and Gabon has no separate sui generis database right.

Reproducing a protected work without authorization is illicit and is punished under the Penal Code's provisions on literary and artistic property, with no specific fine amount stated in this law itself.

Articles 28 to 35 of Law No. 027/2023 require any operator of an information system, a term the law defines without any sector or size gate as an organised set of resources that collects, groups, classifies, processes or disseminates information, to take all technical and administrative measures necessary to guarantee the security of the services it offers.

Each operator must adopt standardised systems to identify, evaluate, treat and continuously manage the risks affecting its information systems' security, and must deploy technical mechanisms addressing threats to the systems' continuous availability, integrity, authentication, resistance to repudiation by third-party users, data confidentiality and physical security, with those mechanisms subject to a conformity clearance from the competent administrative authority on its cybersecurity policy.

A person whose activity is to offer users access to an information system must inform them of the danger of using an unsecured system, the need for a parental-control device, the particular risks of a security breach, and the existence of a technical means to restrict access to certain services, and must offer at least one such means. An operator of an information system must retain its connection and traffic data for ten years.

Its networks and information systems are also subject to a mandatory, periodic security audit on terms a regulation sets. Article 98 gives every person concerned by the law six months from its entry into force to comply, under pain of sanctions the article does not itself specify.

Ordonnance n°0011/PR/2026 sets Gabon's digital age of majority at sixteen and prohibits creating an account or profile on any online communication service, social network, or digital platform for a minor under that age, with a narrow carve-out for online encyclopedias, educational, cultural, or scientific directories, free and open-source software development and sharing platforms, and pedagogical content consulted at school with a teacher's supervision and the parent's express consent.

The person holding parental authority is liable for what a minor under sixteen does on a social network or platform in their charge, and that person may have data about the minor erased.

Pornographic content is barred to a minor under eighteen, and the Haute Autorité de la Communication publishes and enforces a technical référentiel setting the minimum requirements an age-verification system must meet, entrusting technical audits of those systems to itself or to the Autorité de Régulation des Communications Electroniques et des Postes (ARCEP) or another independent body with proven expertise.

Within twelve months of the ordinance's publication, every social-network or digital-platform editor must deploy an effective technical mechanism to verify a user's age at registration.

The editor must block or suspend posting, sharing, and social-interaction features for an account identified as belonging to a user under sixteen unless parental consent is formally registered, disable by default any feature letting an unidentified person contact a minor's account directly, filter out algorithmic recommendation of AI-generated violent, sexual, or psychologically harmful content to accounts identified as minors, and report quarterly on the number of minor accounts detected, blocked, or removed and the verification methods used.

A user's own false declaration of age does not relieve the platform of this duty of reasonable vigilance. An editor must also acknowledge a cyberbullying report or a report of harmful content involving a minor within twenty-four hours and decide and notify the user within seventy-two hours.

Loi n°1/87 permits, provided the title of the work and the author's name are given, an analysis or short quotation drawn from a work already lawfully made accessible to the public, conforming to fair practice and justified by a scientific, critical, polemical, educational, or informational purpose, expressly including a quotation from a newspaper article or periodical reproduced as part of a press review, in either the original or a translation.

Separately, provided the author's name and source are given and the right of reproduction has not been expressly reserved, the press may reproduce or broadcast for informational purposes a current economic, political, or religious news article published or broadcast in the original or in translation, or a speech delivered before a deliberative assembly, a public court hearing, or a public political meeting or official ceremony.

Reproducing a protected work outside these exceptions is illicit and, for a work made available to the public without authorization, exposes both the person who let it happen on their premises and whoever materially committed the reproduction to civil liability.