Data protection & privacy law in Equatorial Guinea (2026)
Data protection in Equatorial Guinea: comprehensive law.
Equatorial Guinea enacted a standalone comprehensive personal data protection law in 2016, Law No. 1/2016, establishing GDPR-style principles (purpose limitation, data minimisation, transparency, security) and individual rights over personal data. A dedicated supervisory authority, the Órgano Rector de Protección de Datos Personales, was created by the law but had not become operational as of early 2026, leaving enforcement capacity very limited in practice. The 2016 law is supplemented by Internet Communication Law No. 1/2017, which extends data protection obligations to electronic commercial communications.
Legal framework
Law No. 1/2016 on the Protection of Personal Data (Ley No. 1/2016 de Protección de Datos Personales), enacted 22 July 2016; supervisory authority: Órgano Rector de Protección de Datos Personales (established by law but not yet operational as of 2026)
Key points: data & privacy in Equatorial Guinea
Constitutional foundation
Article 13 of the Constitution of Equatorial Guinea guarantees the right to privacy of domicile and communications, providing the constitutional basis on which statutory data protection obligations rest.
Law No. 1/2016, primary instrument
Enacted on 22 July 2016, Law No. 1/2016 on the Protection of Personal Data is the principal data protection statute. It establishes core principles of transparency, purpose limitation, data minimisation, accuracy, storage limitation, and integrity/confidentiality, broadly mirroring international frameworks. The law is available only in Spanish.
dlapiperdataprotection.com cyrilla.org dataprotection.africa
Supervisory authority, non-operational
The Órgano Rector de Protección de Datos Personales was created by Law No. 1/2016 as the dedicated supervisory body. As of early 2026, it had still not become operational; registration of personal data files falls to the General Data Protection Registry under its Technical Secretariat in the interim.
Controller obligations
Data controllers must adopt appropriate technical and organisational security measures, maintain records of processing activities, and notify both the relevant authority and affected data subjects in the event of a personal data breach.
Internet Communication Law No. 1/2017
Law No. 1/2017 on Internet Communications (January 2017) supplements the 2016 law by requiring that commercial electronic communications, including advertising and promotions, comply with data protection rules on the creation, maintenance, and cessation of use of personal data files; data used for such purposes must be clear and identifiable.
AU Malabo Convention, not ratified
Equatorial Guinea hosted the adoption of the African Union Convention on Cyber Security and Personal Data Protection (Malabo Convention) in Malabo in June 2014 but has not ratified it. The Convention entered into force in June 2023 on the basis of other states' ratifications; Equatorial Guinea is not among the 15 ratifying states.
Sources
- dlapiperdataprotection.com/?t=law&c=GQ
- dlapiperdataprotection.com/index.html?t=authority&c=GQ
- cyrilla.org/entity/yf8eiw9h3g?page=5&file=1721651158058guqswwp1w6r.pdf
- dataprotection.africa/equatorial-guinea/
- dataguidance.com/jurisdictions/equatorial-guinea
- mofo.com/privacy-library/equatorial-guinea
- dataprotection.africa/malabo-convention-set-to-enter-force/
Next for Equatorial Guinea: Digital Payments & FintechPartial
Next topicOrientation, not legal advice: verify against the primary sources linked above. Last verified 24 May 2026. Methodology & how to cite · State of Technology Regulation 2026