Gabon

GA · GAB · Middle East & Africa

2 regulators · 2 laws & regulations · 7 obligations · 1 enforcement action

Obligation	Timing	Regulator	Arises from	Source
All industries
Lawful basis, notice and data subject rights	Ongoing	APDPVP	—	source
Art. 71 requires consent or another listed ground such as legal obligation, contract or legitimate interest, and Art. 72 puts the burden of proving consent on the controller. Data subjects have rights of access (Arts. 43-47), rectification (50-52), erasure (53), restriction (55-57), portability (58-59), objection (60-65) and protection against automated decisions (66-69); Art. 74 requires parental authorisation for children under 18.
Personal data breach notification	Deadline Without undue delay	APDPVP	—	source
Art. 79 requires the controller to notify the supervisory authority of a data breach likely to seriously affect individuals' fundamental rights, 'sans délai excessif'. The article gives no fixed number of hours.
Banking
AML record retention	Retention period 10 years	—	—	source
Art. 39(1) requires identity records to be kept for at least ten years from the closure of the account, and transaction records and related documents for at least ten years after the transaction. Art. 39(2) sets a five-year period for certain intermediary-institution information.
AML/CFT compliance programme and compliance officer	—	—	—	source
Art. 15(a) requires internal policies, staff training and the appointment of a money laundering, terrorist financing and proliferation financing control officer at management level. Art. 27 requires internal policies approved by the policy-making organ and Art. 28(d) provides for a compliance officer.
Customer due diligence (KYC/CDD)	At onboarding + ongoing	—	—	source
Art. 20 requires identification and verification before entering a business relationship or assisting a transaction. Art. 21 requires ongoing vigilance and updating of customer information, Art. 29 lists the cases requiring identification and Art. 33 sets out identification of beneficial owners of legal persons and arrangements.
Crypto / VDA
Travel-rule information for virtual asset transfers	Deadline On each virtual asset transfer	—	—	source
Art. 42(5)(a) and (b) set out originator and beneficiary information that must accompany virtual asset transfers; Art. 42(4) requires enhanced vigilance for occasional transactions above 500,000 CFA francs.
VASP authorisation before operating	Deadline Prior approval before operating	—	—	source
Art. 42(1) prohibits operating as a virtual asset service provider without prior approval or authorisation from the competent authority. The 2026 FATF follow-up report says COSUMAF is the only designated authority and cites Arts. 336-338 of its General Regulation. The 2023 mutual evaluation found VASPs unregulated at that date.
No obligations match these filters.