Loi n° 001/2011 du 25 septembre 2011 relative à la protection des données à caractère personnel (Law No. 001/2011 of 25 September 2011 on the Protection of Personal Data)

Loi n° 001/2011 du 25 septembre 2011 relative à la protection des données à caractère personnel (Law No. 001/2011 of 25 September 2011 on the Protection of Personal Data) is Gabon's primary data protection legislation. It was enacted on 25 September 2011 and published in the Journal Officiel de la République Gabonaise, N° 74, dated 24 - 31 October 2011. The law was substantively amended by Loi n° 025/2023 of 9 July 2023, which strengthened the regulatory framework, expanded the powers of the supervisory authority, and significantly increased penalties. The law applies to the automated or partially automated processing of personal data, as well as to manual processing where data is held in a structured filing system. It covers controllers established in Gabon and non-established controllers where the processing relates to data subjects in Gabon. Personal data is defined to include any information capable of identifying a natural person, whether directly or indirectly. The law imposes on controllers and processors substantive obligations, including requirements of lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, and storage limitation. The law grants data subjects rights of access, rectification, erasure, and objection. Data subjects also have the right to object to processing for direct marketing and to automated decision-making that significantly affects them. Controllers are required to notify the supervisory authority before commencing processing. Processing of sensitive categories of data requires prior authorisation. Sensitive categories include data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health, sexual life, genetic data, and data concerning criminal offences and convictions. Cross-border transfers are permitted where the receiving country provides an adequate level of protection, or where appropriate safeguards are in place. Controllers must implement appropriate technical and organisational security measures. The 2023 amendment (Loi n° 025/2023) significantly increased fines to a range of 1 million to 100 million CFA francs, with additional fines of up to 10 million CFA francs for serious violations. The 2023 amendment also renamed the supervisory authority from the Commission Nationale pour la Protection des Données à Caractère Personnel (CNPDCP) to the Autorité pour la Protection des Données Personnelles et de la Vie Privée (APDPVP), an independent administrative authority with enhanced structural independence. Original language: French. Full text of the 2011 law is available via the Association Francophone des Autorités de Protection des Données Personnelles (AFAPDP) and in the Journal Officiel de la République Gabonaise. Full text of the 2023 amendment is available from AFAPDP and the Journal Officiel.

1. 1All processing must be notified to the supervisory authority before commencement; processing of sensitive categories requires prior authorisation
2. 2Sensitive categories include ethnic origin, political opinions, religious beliefs, trade union membership, health, sexual life, genetic data, and criminal records
3. 3Cross-border transfers permitted only to countries with adequate protection, or where appropriate safeguards are in place
4. 4Data subjects hold rights of access, rectification, erasure, and objection, including to direct marketing and automated decision-making
5. 5Fines range from 1 million to 100 million CFA francs under the 2023 amendment; additional penalties up to 10 million CFA francs for serious violations
6. 6Supervisory authority renamed from CNPDCP to APDPVP by Loi n° 025/2023 of 9 July 2023, with expanded independence and enforcement powers
7. 7Processing for direct marketing or automated profiling is subject to data subject opt-out rights