Key Facts
Overview
The Gambia enacted its first comprehensive data protection law in November 2025, establishing a modern framework with GDPR-level penalties. The Personal Data Protection and Privacy Act designates the Information Commission as the National Data Protection Commission. Unlike most African data protection laws, the PDPP Act does not require prior registration before processing, instead focusing on accountability-based compliance with 72-hour breach notification requirements.
What This Means for Your Website
Websites collecting personal data from individuals in The Gambia must obtain freely given, specific, informed, and unambiguous consent. Unlike many African jurisdictions, you do not need to register with the Commission before processing. However, you must notify the Commission within 72 hours of discovering a data breach and notify affected individuals without undue delay for high-risk breaches. Data Protection Impact Assessments are required for high-risk processing activities.
Key Requirements
Consent must meet the GDPR-standard threshold of being freely given, specific, informed, and unambiguous. The penalty framework is among Africa's most severe: administrative fines of GMD 1 million or 5% of gross income, escalating to 4% of global turnover for serious violations. Criminal penalties include up to 10 years imprisonment for selling personal data, 7 years for obstruction of investigations, and 2 years for concealing data breaches. Breach notification must reach the Commission within 72 hours.
How ConsentStack Handles This
ConsentStack identifies visitors from The Gambia and presents an opt-in consent banner meeting the law's standard of freely given, specific, informed, and unambiguous consent. All non-essential scripts are blocked until consent is obtained. Consent records are stored with full audit trails including timestamps and preference details, supporting accountability requirements and breach notification compliance.
Penalties
Administrative: GMD 1,000,000 or 5% of gross income. Serious/aggravated: 4% of global turnover. Criminal: up to 5 years imprisonment; aggravated: up to 10 years plus GMD 10,000,000 for corporations. Concealing breach: 2 years. Obstruction: 7 years.
Key Requirements
- Consent must be freely given, specific, informed, and unambiguous
- No prior registration required before processing (departure from African trend)
- 72-hour breach notification to Commission
- Data subjects must be notified without undue delay for high-risk breaches
- Data Protection Impact Assessments required for high-risk processing
- Data subjects have comprehensive rights including access, rectification, and erasure
Notable Provisions
- 4% global turnover penalty mirrors GDPR
- Criminal penalties for selling personal data (up to 10 years)
- Criminalization of concealing data breaches (2 years) and obstruction (7 years)
- No prior registration requirement, unusual for Africa
Other Sub-Saharan Africa Regulations
Frequently Asked Questions
Does The Gambia require cookie consent?
The PDPP Act 2025 does not have specific cookie provisions, but personal data collected through cookies requires freely given, specific, informed, and unambiguous consent under the general processing rules.
What are the penalties under The Gambia's data protection law?
Administrative fines reach GMD 1 million or 5% of gross income. Serious violations face 4% of global turnover. Criminal penalties include up to 10 years imprisonment for selling personal data and 7 years for obstruction.
Do I need to register before processing data in The Gambia?
No. Unlike most African data protection laws, The Gambia's PDPP Act does not require prior registration before processing personal data, instead relying on an accountability-based compliance model.
How quickly must data breaches be reported in The Gambia?
Data breaches must be reported to the Information Commission within 72 hours of discovery. Affected individuals must be notified without undue delay for high-risk breaches. Concealing a breach is a criminal offence carrying up to 2 years imprisonment.
Stay compliant with PDPP Act 2025
ConsentStack helps you implement Opt-in consent for Republic of The Gambia automatically.