Gabon

Gabon regulates personal data through Law No. 001/2011 of 25 September 2011, substantively amended by Law No. 025/2023 of 9 July 2023. The 2011 law applies to automated or partly automated processing and to manual processing in structured filing systems, covering controllers established in Gabon and non-established controllers whose processing relates to data subjects in Gabon. It imposes the standard obligations, lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, and storage limitation, and grants data subjects rights of access, rectification, erasure, and objection, including to direct marketing and to automated decision-making that significantly affects them. Processing must be notified to the supervisory authority before it begins, and sensitive categories, racial or ethnic origin, political opinions, religious beliefs, trade union membership, health, sexual life, genetic data, and criminal-offence data, require prior authorisation. Cross-border transfers are permitted only to countries with adequate protection or under appropriate safeguards. The 2023 amendment is the more consequential development: it sharply increased penalties (now a range of 1 million to 100 million CFA francs, with additional fines up to 10 million CFA francs for serious violations) and strengthened the regulator's independence and enforcement powers. That amendment also renamed and restructured the supervisory authority, from the Commission Nationale pour la Protection des Données à Caractère Personnel (CNPDCP) to the Autorité pour la Protection des Données Personnelles et de la Vie Privée (APDPVP), an independent administrative authority with expanded structural independence. With a long-standing law, a clear 2023 modernising amendment, and a named, restructured regulator, Gabon presents a relatively developed Central African regime.