Cybersecurity regulation in Gabon (2026)

Loi No. 027/2023 of 11 July 2023 is the cornerstone statute requiring all public and private organisations to conform to rigorous security standards; a six-month compliance deadline was set from the law's entry into force.

The 2023 law contains dedicated provisions obliging critical infrastructure operators to implement and maintain organisational and technical security measures for their systems and services.

Personal data breaches must be notified to the APDPVP (Autorité de Protection des Données à caractère Personnel et de la Vie Privée) under Loi No. 025/2023, which aligns Gabon's notification regime with GDPR-influenced standards.

Loi No. 027/2023 imposes criminal sanctions including up to 10 years' imprisonment and fines up to 100 million CFA francs for offences such as unauthorised access to computer systems.

In October 2024 Gabon's Council of Ministers approved a ratification bill for the AU Convention on Cybersecurity and Personal Data Protection (Malabo, 2014); by December 2024 the bill had been presented to the National Transitional Assembly, positioning Gabon as the 16th AU state to ratify.

Loi No. 027/2023 supersedes Ordonnance No. 15-PR-2018 on cybersecurity and cybercrime, which was the primary instrument from 2018 to 2023, alongside the original personal data protection law Loi No. 001-2011.