Population: 1,402,985

Capital: Malabo

President: Teodoro Obiang Nguema Mbasogo

2021 Freedom House Score: 5/100

Data protection law? Yes, but data protection authority not yet appointed

Privacy enshrined in Constitution: Yes, the Constitution of Equatorial Guinea protects the privacy of the domicile and communications under Article 13.

DPA legislation: While Equatorial Guinea has a comprehensive data protection law in the form of Law No. 1/2016 on the Protection of Personal Data, the Law is currently only available in Spanish. As such, we have been unable to analyse its provisions. The Law creates the Governing Body for the Protection of Personal Data (el Órgano Rector de Protección de Datos Personales) as the data protection authority, but it is not yet operational.

ICCPR: Acceded

Council of Europe Convention 108: No

Council of Europe Convention 185: No

Malabo Convention: No

ECOWAS Supplementary Act on Personal Data Protection: No

Council of Europe Additional Protocol to Convention 108 (Treaty No. 181): No

Applies to natural persons: Unknown

Applies to juristic persons: Unknown

Applies to public entities: Unknown

Domestic/personal purposes exclusion: Unknown

National security exclusion: Unknown

Law enforcement exclusion: Unknown

Cabinet or Executive Council exclusion: Unknown

Judicial functions exclusion: Unknown

Journalistic, literary or artistic purposes exclusion: Unknown

Temporary copies exclusion: Unknown

Other exclusion(s): Unknown

Broad or vague exclusions: Unknown

Applies to foreign entities: Unknown

Excludes foreign entities that only transit personal data through the country: Unknown

It is currently unclear how personal data is defined.

It is currently unclear what provisions apply to the collection and processing of personal information.

Notification that data is being processed: Unknown

Notification to DPA in event of data breach: Unknown

Notification to data subject in event of data breach: Unknown

Timeframe for notification is specified: Unknown

Exceptions exist to breach notifications: Unknown

Requires a data processing register: Unknown

Register is publicly available: Unknown

Provides for terms of service icons: Unknown

DPA must submit at least annual report: Unknown

DPA report is made public: Unknown

Explicit provision for civil liability: Unknown

Established/designates a Data Protection Authority: Unknown

DPA is empowered to investigate: Unknown

DPA is empowered to subpoena or request evidence: Unknown

Law provides for criminal penalties: Unknown

Law provides for administrative penalties: Unknown

DPA is independently structured (does not exist within or receive instructions from another public body): Unknown

DPA receives funding directly from the state budget/legislative body: Unknown

DPA may receive some forms of external funding/own revenue: Unknown

Adequate protections against undue removal: Unknown

Number of members in DPA: Unknown

Maximum term length for members of the DPA (years): Unknown

Right of data subject to access a copy of their personal data: Unknown

Right of data subject to request a correction of data: Unknown

Right of data subject to request deletion of data: Unknown

Justification required for a request for deletion: Unknown

Defines the requirements for consent: Unknown

DPA is mandated to participate in policy formulation: Unknown

Unknown.

Provides a right not to be subject to automated decision-making: Unknown