Gabon Law 001/2011 and AI: where is your teams' data really going?
Oil, banking, government: in Gabon, every prompt sent to ChatGPT is a transfer out of the country. What Law 001/2011 and the APDPVP say, and what to do.
In Port-Gentil, an engineer at an oilfield services company asks ChatGPT to summarise an incident report. The document lists the technicians on site, their phone numbers and extracts from medical files. In a second, that information has travelled to servers thousands of kilometres from Gabon.
That invisible journey raises a simple question: who controls Gabonese people's data once it passes through an AI assistant? Law No. 001/2011 on the protection of personal data, amended in 2023, and the authority that enforces it give a clear answer, one that many companies still overlook.
An early law, strengthened in 2023
Gabon was among the first Central African countries to adopt a personal data law. Law No. 001/2011 set up the National Commission for the Protection of Personal Data (CNPDCP).
In 2023, a reform carried by Law No. 025/2023 amended that text and turned the commission into the Authority for the Protection of Personal Data and Privacy (APDPVP), with stronger powers. The authority has since become more visible, for instance by summoning the 2025 presidential candidates over the use of voters' data, and by working with the Ministry of Digital Economy on the Gabon Digital project.
The country also passed a law on cybersecurity and cybercrime in 2023 and, in October 2024, ratified the African Union Convention on Cyber Security and Personal Data Protection, known as the Malabo Convention.
Transfers out of Gabon: the basic rule
For generative AI, the key issue is international transfer. As a rule, personal data may only leave Gabon for a country that offers an adequate level of protection. Otherwise, a transfer is allowed only in limited cases: the person's explicit consent, performance of a contract, protection of someone's life, public interest or the defence of a legal claim.
Most consumer AI assistants process data outside the continent. When an employee pastes a customer list into a chatbot, they carry out an international transfer with no legal basis, no notice to the people concerned and no entry in the company's records.
Data that needs prior authorisation
Gabonese law separates processing that only needs a declaration from processing that requires prior authorisation from the APDPVP. The second group includes:
biometric data used to check identity;
national identification numbers, such as the NIP;
data on offences and convictions;
genetic data used outside medical care;
some profiling operations.
A company cannot let this data flow freely into AI tools when processing it in the first place already needs the authority's approval.
People's rights matter too. A customer or employee can ask which of their data was processed, and by whom. If their information went through an AI tool without the company knowing, it simply cannot give a proper answer. The issue is not only legal, it goes to the organisation's ability to account for what it does.
Oil, banking and the public sector: three risk profiles
Oil and gas
Operators and contractors in Port-Gentil and Libreville handle staff files, occupational health data and sensitive contracts. Many teams work with foreign parent companies, which multiplies data flows out of the country.
Banking
Gabonese banks hold identities, income details and transaction histories. A credit analyst who asks an AI to summarise a loan file exposes exactly the kind of information customers expect to stay protected.
Government
Public bodies must appoint a data protection officer. As public services go digital and the NIP rolls out, civil servants handle more and more civil registry data. Uncontrolled AI use in these services would hit citizens' trust directly.
Sovereignty is decided at the workstation
Sovereignty is often discussed in terms of national data centres. That matters, but it is not enough. Data first leaves through the browser, at the moment an employee types or pastes text. That is where control has to sit.
The right approach is to spot personal data before the prompt is sent and replace it with fake values in the same format. The AI gets usable text, yet no real data leaves Gabon. Our article on format preserving anonymization explains the method, and our analysis of sovereign AI from the CISO's seat shows why hosting alone does not solve everything.
Where to start
List the AI tools actually in use, including on personal accounts.
Identify data that needs authorisation and keep it out of prompts.
Document transfers to AI providers and their legal basis.
Train teams with concrete examples from their own work.
Deploy endpoint control that warns, anonymises or blocks, and keeps evidence of incidents for the APDPVP.
To schedule these steps, our 90-day rollout playbook offers a realistic timeline. The issues are close to those in the wider region, covered in our report on generative AI in West Africa.
Key takeaways
Law 001/2011, amended in 2023, governs personal data in Gabon under the APDPVP's supervision.
A prompt sent to an AI hosted abroad is an international transfer.
National identifiers and biometric data require prior authorisation.
Real sovereignty starts at the workstation, before anything is sent.
ZeusLock detects and anonymises personal data right in the browser, before it leaves Gabon for ChatGPT, Copilot or Gemini. Book a demo to keep control of your data.
Protect your data from AI leaks
See ZeusLock stop sensitive data before it reaches ChatGPT, Claude, Gemini and more, in a 30-minute demo.
