Data protection & privacy law in Gambia (2026)

Legal framework

Personal Data Protection and Privacy Act, 2025 (PDPP); supervised by the Information Commission (established under the Access to Information Act, 2021)

Key points: data & privacy in Gambia

1. 01Enactment & Scope

   The PDPP was passed unanimously on 29 September 2025 and assented to on 7 November 2025, making it Gambia's first comprehensive data-protection law. It covers automated processing and structured non-automated processing of personal data; purely personal or household activities are excluded.

   voicegambia.com techhiveadvisory.africa

2. 02Supervisory Authority

   The Information Commission, originally created under the Access to Information Act, 2021, is designated as the data-protection authority, responsible for oversight, investigations, audits, public education, complaint handling, and imposing administrative fines. The dual mandate (access to information plus data protection) presents a resourcing challenge flagged by analysts.

   techhiveadvisory.africa gambiadaily.gov.gm

3. 03Data Subject Rights

   Data subjects hold rights to be informed, to access their data, to rectification, erasure ('right to be forgotten'), restriction of processing, data portability, and objection to automated decision-making. Controllers must respond within one month, extendable under defined conditions.

   africanlawbusiness.com lexology.com

4. 04Controller & Processor Obligations

   Controllers must process on a lawful basis, conduct Data Protection Impact Assessments for high-risk activities, appoint a Data Protection Officer where required, and notify the Information Commission of data breaches within 72 hours. A stricter regime applies to sensitive categories including genetic, biometric, health, racial-origin, and political-opinion data.

   techhiveadvisory.africa malagen.org

5. 05Extraterritorial Application

   The PDPP applies to controllers outside The Gambia whenever their processing relates to individuals within the country's jurisdiction, a broader extraterritorial reach than GDPR, which conditions applicability on the offering of goods/services or monitoring of behaviour.

   lexology.com digitalpolicyalert.org

6. 06Cross-Border Transfers & Penalties

   Transfers abroad require the recipient country or organisation to offer an adequate level of protection; in its absence, Commission-approved safeguards (standard instruments or ad hoc agreements) are required. Administrative fines can reach the greater of GMD 1,000,000 (approx. EUR 11,500) or 5% of the prior year's gross income. Unlike many African peers, no prior registration with the Commission is required before commencing processing.

   digitalpolicyalert.org captaincompliance.com dataprotection.africa

Sources

1. 1.voicegambia.com/2025/09/30/gambia-passes-first-ever-personal-data-protection-and-priv
2. 2.techhiveadvisory.africa/insights/review-of-gambias-personal-data-protection-and-privacy-act-2
3. 3.africanlawbusiness.com/uncategorized/key-features-of-the-gambian-personal-data-protection-an
4. 4.lexology.com/library/detail.aspx?g=387121e2-ea1d-46d2-b527-b633be615fdf
5. 5.dataprotection.africa/the-gambia/
6. 6.digitalpolicyalert.org/change/16681-cross-border-data-transfer-regulation-in-data-protection
7. 7.gambiadaily.gov.gm/governance-framework-prospective-information-data-protection-commissi
8. 8.captaincompliance.com/education/gambia-personal-data-protection-and-privacy-act/
9. 9.malagen.org/media-monitoring/explainer-what-the-gambias-personal-data-protection-