Embedded Files
User Guide to the Personal Data Protection and Privacy Act, 2025
A Practical Guide for Businesses and the Public in The Gambia
Introduction
The Personal Data Protection and Privacy Act, 2025 regulates the collection, storage, use, disclosure and protection of personal data in The Gambia. The Act applies to both public and private sector organisations that process personal data and grants enforceable rights to individuals whose information is being processed. Sections 3, 4 and 5.
PART A: GUIDE FOR BUSINESSES AND ORGANISATIONS
1. Understand the Core Principles of Data Protection
Every controller must ensure that personal data is:
Fairly, Transparently and Lawfully Processed
Section 4(1)(a).
Collected for Specific and Legitimate Purposes
Section 4(1)(b).
Accurate and Kept Up to Date
Section 4(5)(b).
Adequate, Relevant and Not Excessive
Section 4(5)(a).
Protected Against Loss, Misuse and Unauthorised Access
Section 4(5)(e).
Deleted When No Longer Required
Sections 4(5)(d) and 10(2).
Business Action: Conduct regular audits of the personal information you collect and retain only information necessary for legitimate business purposes.
2. Establish a Lawful Basis for Processing
An organisation may process personal data only where at least one lawful basis exists.
Lawful Bases Include:
Consent of the individual. Section 5(2)(a).
Performance of a contract. Section 5(2)(b).
Compliance with a legal obligation. Section 5(2)(c).
Protection of vital interests. Section 5(2)(d).
Public interest tasks. Section 5(2)(e).
Legitimate interests. Section 5(2)(f).
Practical Example: An employer may process payroll information because it is necessary to perform an employment contract and comply with tax obligations.
3. Obtain Valid Consent
Where consent is relied upon:
Consent Must Be:
Freely given. Section 8(2).
Specific. Section 8(4).
Informed. Sections 8(3) and 25(2).
Unambiguous. Section 2 (definition of consent).
Individuals Must Be Able to:
Withdraw consent at any time. Section 8(5).
Be informed of their right to withdraw. Section 8(6).
4. Processing Sensitive Personal Data
Special categories of personal data include:
Health information.
Biometric information.
Genetic information.
Religious beliefs.
Political opinions.
Criminal records.
Definition of "special categories of personal data" and Section 6.
Processing is generally prohibited unless one of the conditions listed in Section 6(1)(a)-(i) applies.
5. Processing Children's Data
Controllers processing information relating to children must:
Ensure the Child's Best Interests Are Paramount
Section 7(1)(b).
Apply Additional Safeguards
Section 7(2).
Use Clear Child-Friendly Language
Section 7(3).
Obtain Appropriate Parental or Guardian Consent
Section 7(5)(a).
6. Privacy Notices and Transparency
Controllers must inform individuals about:
Identity and contact details of the controller.
Purpose of processing.
Legal basis for processing.
Categories of personal data collected.
Recipients of the data.
Available rights.
Section 25(2)(a)-(e).
7. Data Protection by Design and Default
Controllers and processors must:
Assess Risks Before Processing
Section 28(1).
Build Data Protection Into Systems and Procedures
Sections 28(2) and 28(3).
Use Privacy-Friendly Default Settings
Section 28(4).
Avoid Excessive Collection of Data
Section 28(5).
8. Information Security Obligations
Controllers and processors must implement appropriate safeguards including:
Encryption.
Pseudonymisation.
Access controls.
System resilience and recovery mechanisms.
Security testing.
Sections 29(1) and 29(2)(a)-(e).
9. Record Keeping
Businesses must keep records of:
Processing activities.
Categories of personal data.
Data recipients.
Retention periods.
Security measures.
Sections 30(1) and 30(2)(a)-(f).
10. Data Protection Impact Assessments
A Data Protection Impact Assessment (DPIA) is required where processing is likely to create a high risk to individuals.
Examples include:
Large-scale profiling.
Large-scale processing of sensitive data.
Large-scale surveillance.
Sections 31(1) and 31(2)(a)-(c).
11. Personal Data Breaches
Notification to the Information Commission
Data breaches must be reported within 72 hours unless the breach is unlikely to create a high risk.
Section 32(1).
Notification to Affected Individuals
Where the breach creates a high risk to individuals, affected persons must also be informed.
Section 33(1).
12. Appointment of a Data Protection Officer
A Data Protection Officer must be appointed where:
A public authority processes data.
Large-scale monitoring occurs.
Large-scale sensitive data processing occurs.
Section 34(1)(a)-(c).
PART B: GUIDE FOR THE PUBLIC
1. Right to Know and Access Personal Data
You have the right to ask:
Whether your information is being processed.
Why it is being processed.
Who has received it.
How long it will be kept.
Section 9(1)(a)-(g).
You are also entitled to receive a copy of your personal data.
Section 9(1)(h).
2. Right to Correct Personal Data
You may request correction of inaccurate or incomplete information.
Section 10(1).
3. Right to Erasure
You may request deletion where:
The information is no longer necessary.
Consent has been withdrawn.
Processing is unlawful.
Section 10(2)(a)-(e).
4. Right to Restrict Processing
You may request restriction when:
Accuracy is challenged.
Data is needed for legal claims.
You have objected to processing.
Section 10(3)(a)-(c).
5. Right to Object
You may object to processing:
Based on your particular circumstances.
For direct marketing purposes.
Sections 11(1) and 11(2).
Where an objection relates to direct marketing, processing must stop.
Section 11(3).
6. Right Not to Be Subject to Automated Decisions
You may challenge decisions made solely through automated processing where those decisions significantly affect you.
Section 12(1).
7. Right to Assistance from the Information Commission
The Information Commission can assist you in exercising your rights.
Section 13.
8. Right to Compensation
If unlawful processing causes financial loss or other harm, you may seek compensation.
Section 15(3).
Enforcement and Penalties
The Act creates offences for:
Unlawful processing of personal data (Section 16).
Selling personal data (Section 17).
Impersonating a data subject (Section 18).
Re-identification of anonymised data (Section 19).
Concealing personal data breaches (Section 21).
Destroying evidence requested by the Commission (Section 23).
The Role of the Information Commission
The Information Commission is responsible for:
Monitoring compliance.
Receiving complaints.
Conducting investigations.
Issuing guidance.
Imposing sanctions and fines.
Assisting data subjects.
Sections 39 and 40.
Quick Compliance Checklist for Businesses
Requirement
Section
Process data lawfully and fairly
s.4
Identify lawful basis
s.5
Protect sensitive data
s.6
Protect children's data
s.7
Obtain valid consent
s.8
Provide privacy notices
s.25
Maintain security measures
s.29
Keep processing records
s.30
Conduct DPIAs where required
s.31
Report breaches within 72 hours
s.32
Notify affected individuals
s.33
Appoint a DPO where required
s.34
Page updated
Google Sites
Report abuse