Skip to content
World Watch

Data protection & privacy law in Gabon (2026)

Data protection in Gabon: comprehensive law.

Gabon enacted one of Sub-Saharan Africa's earliest comprehensive data protection laws in 2011 (Law No. 001/2011), subsequently modernised by Law No. 025/2023 which entered force on 15 July 2023. The 2023 amendment upgraded the supervisory body from the former CNPDCP to the independent APDPVP, introduced GDPR-influenced rights (portability, erasure, restriction), mandated data-impact assessments for high-risk processing, and tightened breach-notification obligations. The framework applies to all public and private entities processing personal data in Gabon.

Last verified Official sources first · MethodologyCompare Gabon with other countries

Legal framework

Law No. 001/2011 on the Protection of Personal Data (as amended by Law No. 025/2023 of 9 July 2023); supervisory authority: Autorité pour la Protection des Données Personnelles et de la Vie Privée (APDPVP)

Key points: data & privacy in Gabon

  1. Primary legislation

    Law No. 001/2011 of 25 September 2011 on personal-data protection, as substantially amended by Law No. 025/2023 of 9 July 2023, constitutes the comprehensive legal framework governing collection, processing, storage and transfer of personal data.

    journal-officiel.ga afapdp.org

  2. Supervisory authority

    The APDPVP (Autorité pour la Protection des Données Personnelles et de la Vie Privée) is an independent administrative authority established by the 2023 law, replacing the former CNPDCP. It informs data subjects and controllers of rights/obligations and monitors compliance.

    apdpvp.ga rapdp.org

  3. Data subject rights

    Data subjects hold rights to information, access, rectification, erasure, restriction of processing, data portability, objection, and compensation, a set closely modelled on GDPR. Controllers may override the right to object only on demonstration of overriding legitimate grounds.

    dataguidance.com dlapiperdataprotection.com

  4. Breach notification

    Data controllers must notify the APDPVP without undue delay following a personal-data breach, including details of the breach's nature, categories and approximate number of affected individuals, and remediation measures. Where the breach poses a high risk to individuals, data subjects must also be notified individually.

    dlapiperdataprotection.com dataguidance.com

  5. Cross-border data transfers

    Transfer of personal data abroad is permitted only to countries offering an adequate level of protection for privacy and fundamental rights. Transfers to non-adequate countries require specific safeguards or authorisation from the APDPVP.

    dlapiperdataprotection.com dataprotection.africa

  6. Sanctions

    Administrative penalties under the 2023 law range from 1 million to 100 million CFA francs (approx. USD 1,650-165,000), with additional fines of up to 10 million CFA francs for serious violations; criminal liability provisions also apply.

    clym.io dataguidance.com

Sources

  1. journal-officiel.ga/20085-025-2023-/
  2. afapdp.org/wp-content/uploads/2023/12/Gabon-Loi-025-2023-du-12-juillet-2023-port
  3. apdpvp.ga/
  4. rapdp.org/index.php/en/node/63
  5. dlapiperdataprotection.com/index.html?t=law&c=GA
  6. dataguidance.com/opinion/gabon-new-data-protection-act-and-new-authority
  7. dataprotection.africa/gabon/
  8. clym.io/regulations/law-no-0252023-gabon
  9. dlapiperdataprotection.com/?t=breach-notification&c=GA
  10. dataguidance.com/jurisdiction/gabon/

Next for Gabon: Digital Payments & FintechLicensing regime

Next topic

Orientation, not legal advice: verify against the primary sources linked above. Last verified 24 May 2026. Methodology & how to cite · State of Technology Regulation 2026