Privacy Map

The Gambia. Comprehensive data protection. Act

PDPP ActPersonal Data Protection and Privacy Act, 2025

In force
Partly verifiedMedium confidence. Assent/commencement date (2025-11-07) from a single vendor summary; not confirmed in Gazette.

§1Summary

Synopsis

The Gambia's first comprehensive data protection law, giving the Information Commission (created under the Access to Information Act 2021) data protection powers. It follows GDPR concepts including DPOs, 72h breach notice and transfer safeguards.

Key themes
  • lawful bases
  • DPO
  • breach notification
  • cross-border transfers
  • criminal offences
Unique features

Heavy criminal sanctions: corporate fines of at least GMD 1m or 5% of gross income, rising to GMD 10m+ for aggravated offences such as selling personal data; concealing a breach is an offence.

SaaS relevance

SaaS providers processing Gambian data must notify the Commission of breaches within 72h and document transfer safeguards.

§2Obligations

Breach notification
Information Commission within 72h; data subjects without undue delay if high risk
DPO
Conditional
Cross-border transfers
Adequacy or Commission-adopted safeguards, documented assessment
Maximum penalty
Corporate: min GMD 1m or 5% of gross income; aggravated min GMD 10m; up to 10 years' imprisonment

§3Dates

Key dates
  • Adopted
  • In force
  • Passed by National Assembly Sept/Oct 2025; enactment reported 2025-11-07

§4Text and authority

Text
No authoritative text located.
Authority
Information Commission (The Gambia)

§5Where it applies

Domestic law of
The Gambia

§6Sources and verification

Verification

Medium confidence.

Partly verifiedMedium confidence. Assent/commencement date (2025-11-07) from a single vendor summary; not confirmed in Gazette.