Law: Data protection provisions are included in Part XIII of the Information and Communications Act, 2009 (the Information Act)

Regulator: Gambia Public Utilities Regulatory Authority (PURA)

Summary: The Gambia has yet to enact a single comprehensive general data protection law. While the Information Act governs aspects of data processing and retention, it only does so in the context of the provision of information and communication services. In addition, the Public Utilities Regulatory Authority (PURA) issued its Draft Data Protection and Privacy Policy Strategy 2019, which, among other things, sets out data subject rights, however this does not currently have the status of law. Moreover, the Gambia Information and Communications Technology Agency Act 2019 (the ICTA Act) which establishes an agency for ICT, aims to encourage the optimum use of ICT and enforces standards for IT planning including data security and risk management.

Furthermore, the Gambia is a signatory to the Economic Community of West African States (ECOWAS) Supplementary Act A/SA.1/01/10 on Personal Data Protection (the Act). In addition, in 2022, the Gambia has signed the Convention on Cyber Security and Personal Data Protection (the Malabo Convention).