Law: Data protection provisions are included in Part XIII of the Information and Communications Act, 2009 ('the Information Act')

Regulator: Gambia Public Utilities Regulatory Authority ('PURA')

Summary: The Gambia is yet to enact a single comprehensive general data protection law. While the Information Act governs aspects of data processing and retention, it only does so in the context of the provision of information and communication services. In addition, PURA issued its Draft Data Protection and Privacy Policy Strategy 2019, which, among other things, sets out data subject rights, however this does not currently have the status of law. Moreover, The Gambia Information and Communications Technology Agency Act 2019 ('the ICTA Act') which establishes an agency for information and Communications Technology aims to encourage the optimum use of information and communication technologies, and enforces standards for information technology planning including data security and risk management.

Furthermore, The Gambia is a signatory to the Economic Community of West African States ('ECOWAS') Supplementary Act A/SA.1/01/10 on Personal Data Protection ('the Act'), which requires each Member State to establish a data protection authority to ensure that personal data is processed in compliance with the provisions of the Act. Although The Gambia has yet to transpose the Act domestically, once it has been transposed and comes into force, any entity that intends to collect and process personal data of a private individual will be required to make a formal request to the data protection authority.