The Gambia's New Data Protection Law and AI: Why Act Now

For years, The Gambia was one of the few West African countries without a general law on personal data protection. That gap is closing. In late September 2025, the National Assembly passed the Personal Data Protection and Privacy Bill, and its website now lists the text as having received presidential assent.

Still, a law that has been passed is not yet a law that is enforced. It will take time to set up oversight, train staff and publish guidance. Meanwhile, generative AI is settling into banks, hotels and public offices in Banjul and Serrekunda. This article looks at what we know, and at what makes sense to do right now.

Where The Gambia is starting from

Before this text, personal data was only protected in a scattered way, through a handful of sector-specific provisions. No regulator covered processing as a whole. A company could therefore use AI tools with customer data without any clear framework.

The country was not outside every regional framework, though. As a member of ECOWAS, The Gambia is covered by Supplementary Act A/SA.1/01/10 of 16 February 2010 on personal data protection. This text sets common principles: purpose, proportionality, security, individual rights, and the creation of a data protection authority in each member state.

What the new law provides

According to analyses published after its adoption, the text follows international standards. For a company that uses AI, these points matter most:

• Clear principles. Lawfulness, transparency, purpose limitation, data minimization, accuracy, storage limitation and security.

• A data protection officer for public authorities and for organizations that monitor people or process sensitive data on a large scale.

• Impact assessments for high-risk processing.

• Breach notification to the authority within 72 hours.

• Controlled transfers abroad, based on an adequate level of protection or on appropriate safeguards.

• Broad rights, including the right to object to automated decisions.

That last point bears directly on AI. A model that sorts loan applications or job candidates falls within the scope of the law.

What research tells us about AI-related leaks

Data leaks to AI assistants almost always follow the same pattern. No spectacular hack, just a busy employee copying a spreadsheet, a contract or a customer conversation to save time. We described this mechanism in the anatomy of an AI data leak.

Two lessons keep coming back in our work. First, blanket bans move the problem to personal phones instead of solving it. Second, traditional security tools built for email and the network see very little of what happens inside a browser. We explain why in why email DLP fails on ChatGPT.

In our experience, the approaches that work combine three things: a simple rule everyone understands, a technical control at the moment data leaves the device, and a record of what was prevented. None of these depends on a regulator being in place.

The most exposed Gambian sectors

• Banking and money transfers. Remittances from the diaspora play an important role in the economy. Staff handle identities, account numbers and transaction histories.

• Tourism and hospitality. Passport copies, bookings and payment data of foreign visitors, many of them European and themselves covered by the GDPR.

• Telecoms and mobile money. Phone numbers, location data and subscribers' ID documents.

• Public bodies and NGOs. Health, social assistance or civil registry files, sometimes handled with international partners.

In a country where English sits alongside Wolof, Mandinka and Fula, teams also use AI to translate and summarize. These uses are helpful, but they move a lot of data around.

Why act before the authority is in place

1. Data is already leaving. Data sent to an external service today cannot be retrieved tomorrow.

2. Partners demand guarantees. Correspondent banks, European tour operators and donors ask for proof that data is under control.

3. Compliance takes time. A register, impact assessments, a 72-hour procedure: better to build them without pressure.

4. Good practices are already known. The ECOWAS Supplementary Act and neighboring countries' laws provide a solid basis. See our overview of West Africa.

In practice, a realistic first step takes a few weeks: list the AI tools in use, identify the data that must never leave, write a one-page rule and appoint someone responsible. The rest, impact assessments and detailed procedures, can follow over the months. Our 90-day rollout playbook offers a precise schedule.

How ZeusLock can help

ZeusLock runs on employees' devices and browsers. It spots personal data in real time in prompts and files sent to AI assistants, then anonymizes it while keeping its format, warns the user or blocks the request, depending on your rules. Every prevented incident is logged, which feeds your register and your future evidence of compliance.

Key takeaways

The Gambia finally has a modern data law, anchored in the ECOWAS framework. Enforcement will take time, but AI risks are already here. Companies that adopt good practices now will gain time, trust and a head start.

Want to know which data is already leaving your organization? Request a ZeusLock demo.