Gambia

The Gambia recently joined the ranks of West African states with comprehensive data protection law. The Personal Data Protection and Privacy Act, 2025 (PDPPA), passed unanimously on 29 September 2025 and assented to by President Adama Barrow on 7 November 2025, is the country's first comprehensive personal data protection statute. It applies to wholly or partly automated processing and to structured manual files, with extra-territorial reach over controllers and processors outside The Gambia whose processing relates to data subjects in the country. A notable structural departure from the older ECOWAS model is the absence of any prior notification or registration requirement: controllers may begin processing without first registering, in line with the post-GDPR accountability model, demonstrating compliance through records of processing, impact assessments, and DPOs where required. The Act codifies the standard principles and lawful-basis framework, grants rights of access, rectification, erasure, restriction, portability, and objection, and requires breach notification to the supervisory authority within 72 hours, with notice to affected individuals for high-risk breaches. Penalties for a legal entity reach the greater of GMD 1,000,000 or 5% of annual gross income, with aggravated offences (such as unlawful sale of personal data) carrying up to ten years' imprisonment and corporate fines of not less than GMD 10,000,000. Rather than create a new body, the Act designates the Information Commission, established under the Access to Information Act 2021, as the supervisory authority, giving it a dual access-to-information and data-protection mandate with powers to investigate, inquire, enter and search premises, issue binding enforcement notices, and impose fines. With a modern accountability-based statute and a designated regulator, The Gambia has a contemporary framework, though as a 2025 enactment it is very early in implementation.