Cybersecurity law & regulation in Cameroon (2026)
Cybersecurity in Cameroon: comprehensive law.
Cameroon enacted a dedicated Cybersecurity and Cybercriminality Law in 2010 (Law No. 2010/012), establishing a comprehensive legal regime covering electronic security, cybercrime offences, cryptography, and electronic certification, administered by ANTIC. In 2022 Cameroon acceded to the Budapest Convention on Cybercrime, aligning its procedural framework with international standards. A Personal Data Protection Law (No. 2024/017, December 2024) added mandatory breach-notification duties, with a compliance deadline of June 2026.
Legal framework
Law No. 2010/012 of 21 December 2010 on Cybersecurity and Cybercriminality; regulated by ANTIC (National Agency for Information and Communication Technologies) with an in-house CIRT
Key points: cybersecurity in Cameroon
Primary cybersecurity law (2010)
Law No. 2010/012 of 21 December 2010 criminalises unauthorised access, data/system interference, digital fraud, identity theft, and child sexual abuse material; it also establishes the legal regime for electronic evidence, cryptography, and certification. Penalties apply to both individuals and corporate entities.
Regulatory authority, ANTIC & CIRT
ANTIC regulates electronic security activities, operates Cameroon's Public Key Infrastructure, and runs a Computer Incident Response Team (CIRT) that processes approximately 200 GB of threat data and handles around 200 urgent cyber-related judicial requisitions daily.
Budapest Convention accession (2022)
Law No. 2022/002 of 27 April 2022 authorised accession to the Budapest Convention on Cybercrime; Decree No. 2022/169 of 23 May 2022 proclaimed accession, bringing Cameroon's procedural and international-cooperation provisions into alignment with the Convention.
Personal Data Protection Law & breach notification (2024)
Law No. 2024/017 of 23 December 2024 requires data controllers and processors to notify the data protection authority and affected data subjects 'immediately' upon becoming aware of any breach (all breaches, not only serious ones). Controllers and processors are jointly and severally liable for unlawful disclosure. An 18-month compliance grace period runs until 23 June 2026.
Security audit obligations
Under Law No. 2010/012, network operators and electronic service providers must submit to mandatory security audits overseen by ANTIC. Since January 2024, ANTIC's audits of public administrations and private companies identified 8,502 vulnerabilities, illustrating active enforcement of these obligations.
Absence of a formal national cybersecurity strategy
Timeline of decisions
- GuidanceANTIC Reports Explosion of Cyberattacks: 32,500 Judicial Requisitions in 2025
ANTIC processed 32,500 judicial requisitions in 2025, a 30% increase over 2024, equating to roughly 200 per day, and identified 8,502 vulnerabilities and 8,499 fake accounts impersonating senior officials since January 2024. The figures mark the most acute threat environment Cameroon has recorded and reflect growing digitisation of crime.
Digital Business Africa / ANTIC
- DecisionWorld Bank-Funded PATNUC Project Delivers FCFA 735 Million in CIRT Infrastructure
Under the World Bank-financed Project for the Acceleration of Digital Transformation of Cameroon (PATNUC), MINPOSTEL equipped ANTIC's CIRT with five high-performance servers, three digital-investigation platforms, twenty storage consoles, thirty specialised workstations, and penetration-testing tools, the largest single upgrade to Cameroon's national cyber-incident response capacity.
Business in Cameroon
- Decision · officialDecree No. 2022/169 Formally Proclaims Accession to the Budapest Convention on Cybercrime
President Biya signed Decree No. 2022/169 proclaiming Cameroon's accession to the Council of Europe's Budapest Convention on Cybercrime, the world's pre-eminent cybercrime treaty, binding Cameroon to harmonised substantive offences, electronic-evidence procedures, and mutual legal assistance across its 60-plus state parties.
Council of Europe Octopus Cybercrime Community
- Decision · officialDecree No. 2019/150 Reorganises ANTIC and Reinforces Its Regulatory Powers
President Biya signed Decree No. 2019/150 updating the organisation and functioning of ANTIC, explicitly granting it powers of injunction over operators and affirming its mandate to regulate, control, and monitor information-system security, electronic certifications, and ICT ethical use across public and private entities.
Council of Europe Octopus Cybercrime Community
- Law · officialDecree No. 2012/1643/PM, mandatory security audits for electronic networks
The Prime Minister's decree established conditions and modalities for compulsory security audits of all electronic communications networks and information systems in Cameroon, operationalising the audit framework sketched in the 2010 Cybersecurity Law and giving ANTIC supervisory authority over private-sector compliance.
ANTIC (National Agency for Information and Communication Technologies)
- Decision · officialDecree No. 2012/1643/PM Establishes Mandatory Security Audit Regime
The Prime Minister signed Decree No. 2012/1643/PM fixing the terms and modalities of compulsory security audits for all electronic communications networks and information systems, requiring operators to notify ANTIC of intrusions and to bear audit costs, the key implementing regulation that operationalised the audit mandate in the 2010 Cybersecurity Law.
Ministry of Posts and Telecommunications (minpostel.gov.cm)
- Law · officialLaw No. 2010/012 on Cybersecurity and Cybercriminality, Cameroon's Foundational Cyber Law
Cameroon's National Assembly adopted its landmark Cybersecurity and Cybercriminality Law, one of Africa's earliest dedicated cybercrime statutes, criminalising unauthorised access, data fraud, identity theft, child pornography, and online hate speech; mandating security audits for ISPs and operators; granting legal validity to electronic signatures; and designating ANTIC as Root Certification Authority and primary national cybersecurity regulator.
Ministry of Posts and Telecommunications (minpostel.gov.cm)
- Decision · officialANTIC Established by Presidential Decree No. 2002/092
The government created the National Agency for Information and Communication Technologies (ANTIC) as the primary ICT regulatory body responsible for electronic security, certification, internet governance, and implementing the national ICT strategy. ANTIC subsequently became the institutional home for Cameroon's cybersecurity enforcement and will anchor future AI oversight.
Presidency of the Republic of Cameroon (PRC)
Sources
- minpostel.gov.cm/index.php/en/les-textes/telecoms-tic/lois-telecoms-tic/179-law-no-201
- antic.cm/images/stories/laws/Law%20relating%20to%20cybersecurity%20and%20cyber
- antic.cm/index.php/en/
- coe.int/en/web/octopus/-/cameroon
- coe.int/en/web/octopus/country-wiki-ap/-/asset_publisher/CmDb7M4RGb4Z/content
- prc.cm/en/multimedia/documents/10271-law-n-2024-017-of-23-12-2024-web
- africanlawbusiness.com/expert-views/key-features-of-cameroons-new-data-protection-law/
- pollicy.medium.com/key-features-of-law-2024-017-on-personal-data-protection-in-cameroon-
- pgaction.org/news/cameroon-instrument-budapest-convention.html
- scirp.org/journal/paperinformation?paperid=140884
- digitalbusiness.africa/en/cybersecurity-in-cameroon-in-2025-fake-accounts-hacking-vulnerabil
- antic.cm/index.php/en/mssions/computer-security-audit.html
- scirp.org/pdf/jcc2025132_121733012.pdf
Next for Cameroon: Starting a BusinessModerate
Next topicOrientation, not legal advice: verify against the primary sources linked above. Last verified 24 May 2026. Methodology & how to cite · State of Technology Regulation 2026