The Gambia: Hotels, Remittances and AI, Protecting Customer Data

On the Gambian coast, between Kololi and Kotu, hotels are getting ready for the high season. At reception, staff handle bookings, passport copies and special requests from European guests. A few kilometres away, in the money transfer agencies of Serrekunda, agents serve families receiving money sent by relatives in the United Kingdom, Spain or the United States.

These two sectors have something in common: they handle customers' personal data every day, and their teams are starting to use generative AI to work faster. With The Gambia's new data protection law, now is the time to set simple, workable rules.

Two pillars of the Gambian economy

Tourism supports much of the coastal strip, from hotels to guides, travel agencies and restaurants. Visitors arrive mainly in the dry season, often through European tour operators.

Diaspora remittances weigh even more. According to World Bank data, they amounted to about 21% of The Gambia's GDP in 2024, one of the highest shares in Africa. Banks, money transfer operators and mobile payment services therefore process a large volume of data on senders and recipients.

The 2025 law in brief

The Personal Data Protection and Privacy Act, passed in 2025, gives the country a general framework for the first time. According to published analyses, the Information Commission, set up in 2021 for access to information, is in charge of supervising it. It ran awareness sessions in the regions as early as October 2025.

For a hotel or a money transfer service, the key points are: collect only the data you need, keep it secure, notify a breach to the Commission within 72 hours, control transfers abroad, and respect people's right not to be subject to a decision based solely on automated processing. We covered this law in our article on The Gambia's new data protection law and AI.

Hotels and agencies: where AI touches guest data

In tourism, AI is genuinely useful. But some uses expose guests:

• pasting the day's arrivals list, with names, passport numbers and stay dates, to build a schedule;

• drafting a reply to a negative online review and attaching the guest's full booking;

• translating an email that contains medical information, such as an allergy or a disability;

• having a file of loyal guests analysed for a marketing campaign.

European travellers come from countries where the GDPR applies. They care about how their data is used, and their tour operators care even more.

Remittances and fintech: even more sensitive data

In a money transfer service or a fintech, data is both personal and financial. An agent or analyst may be tempted to:

• ask AI to summarise a customer complaint including the sender's name, the recipient's name and the amount;

• paste a transaction statement to spot an anomaly;

• get help drafting a compliance report that contains ID documents;

• test a risk scoring model on real customer data.

That last case directly touches the right to object to automated decisions. The law also sets criminal penalties for certain unlawful processing. A leak of diaspora customer data would also damage trust, which is the main asset of these services.

Diaspora data has one particular feature: it often involves two countries at once. The sender lives in Europe, where the GDPR applies, and the recipient lives in The Gambia, under the new law. A leak can therefore concern several regulators, as well as the transfer service's foreign partners.

Simple rules for everyday work

Small businesses do not need a heavy compliance programme. A few clear rules are enough to start:

1. Never put a passport, ID card or account number into a public AI tool.

2. Replace names with initials or codes before asking for help with an email or an analysis.

3. Use business accounts rather than free personal accounts.

4. Appoint a contact person to report doubts or mistakes to, who knows a breach must be handled within 72 hours.

5. Keep a record of incidents and the measures taken.

These rules work better when a tool reminds people at the moment they paste data. Otherwise they are quickly forgotten in the middle of the season. To see how a leak happens, read the anatomy of an AI data leak.

Hidden uses you should not ignore

In many companies, management does not know which AI tools staff are using. A receptionist uses a phone, a fintech developer uses a coding assistant. These invisible uses have a cost, which we described in the real cost of shadow AI. For a regional view, read our article on AI and data protection in West Africa.

Summary

Tourism and diaspora remittances are at the heart of the Gambian economy, and both depend on customer trust. The 2025 law and the Information Commission now set clear rules. With a few simple habits and a control at the moment of sending, hotels and fintechs can benefit from AI without exposing their customers' data.

ZeusLock spots sensitive data in prompts, anonymises it before sending and keeps an incident log. Book a ZeusLock demo to protect your customers' data.