Data protection & privacy law in Cameroon (2026)

Legal framework

Law No. 2024/017 of 23 December 2024 relating to personal data protection in Cameroon; supplemented by Law No. 2010/012 of 21 December 2010 on Cybersecurity and Cybercriminality. Supervisory authority: Personal Data Protection Authority (Autorité de protection des données à caractère personnel), mandated by the 2024 law but not yet operationally established as of mid-2026.

Key points: data & privacy in Cameroon

1. 01Enacted comprehensive law

   Law No. 2024/017 was signed on 23 December 2024 and published on the Presidency of the Republic's official portal. It supersedes the fragmented privacy provisions of the 2010 Cybersecurity Law and establishes a standalone, comprehensive personal data protection regime.

   prc.cm dataguidance.com

2. 02Compliance grace period

   The law grants controllers and processors an 18-month transition period from enactment, placing the full-enforcement deadline at 23 June 2026. Organisations are expected to audit and align their data-processing operations before that date.

   lexafrica.com africanlawbusiness.com

3. 03Supervisory authority

   The law creates the Personal Data Protection Authority (Autorité de protection des données à caractère personnel), responsible for enforcement, authorisations, complaints handling, and cross-border transfer approvals. The authority was not yet operationally established as of mid-2026; ANTIC (National Agency for Information and Communication Technologies) continues to exercise interim oversight over digital/telecom services.

   africanlawbusiness.com paradigmhq.org

4. 04Data subject rights

   Data subjects hold rights to be informed, access, rectify, erase, restrict, object to, and port their data, mirroring GDPR. Uniquely, heirs may exercise access and update rights on behalf of deceased data subjects at the controller's expense.

   pollicy.medium.com kinsmenadvocates.com

5. 05Sensitive data and controller obligations

   Processing of special categories, including health, biometrics, genetics, racial/ethnic origin, religion, political/trade-union opinions, and criminal records, is prohibited without explicit consent or another legal basis. Controllers must conduct Data Protection Impact Assessments, maintain records of processing, and implement appropriate security measures.

   techhiveadvisory.africa lexafrica.com

6. 06Penalties

   Non-compliance can attract fines of up to 1 billion CFA francs (≈ USD 1.6 million) and criminal imprisonment for responsible executives. The law creates personal liability for senior officers of infringing organisations.

   africanlawbusiness.com clgglobal.com

Timeline of decisions

1. 23 Dec 2024Law · official
   Law No. 2024/017 on Personal Data Protection enacted

   Cameroon's first standalone comprehensive data-protection statute was signed into law, establishing data-subject rights (consent, erasure, objection), prohibiting processing of sensitive categories (health, biometric, ethnic, political data), and creating the Personal Data Protection Authority (APC). Controllers and processors have until 23 June 2026 to comply.

   Presidency of the Republic of Cameroon

2. 1 May 2024Law
   National Assembly adopts data-protection bill

   The Cameroonian National Assembly voted to adopt Bill No. 2062 on Personal Data Protection, completing the legislative stage before presidential assent. The bill had been under deliberation since the May 2023 draft consultations.

   African Law & Business

3. 8 Jun 2023Decision · official
   AU Malabo Convention enters into force

   The African Union Convention on Cyber Security and Personal Data Protection (Malabo, 2014) entered into force after Mauritania became the 15th ratifying state. Cameroon had signed but not ratified, meaning it remains a persuasive regional benchmark rather than binding domestic law.

   African Union

4. 30 May 2023Guidance
   Government publishes draft Data Protection Law and Decree for public consultation

   Cameroon's Ministry of Posts and Telecommunications published a draft data-protection law and accompanying implementation decree, opening formal stakeholder consultations and marking the restart of a legislative process that had stalled for years.

   Paradigm Initiative

5. 22 Mar 2019Decision · official
   Decree No. 2019/150 restructures ANTIC

   The decree reorganised the National Information and Communication Technology Agency (ANTIC), reaffirming it as the primary authority for ICT security, privacy enforcement, consumer protection, and the national Root Certification Authority, filling the regulatory gap left by the absence of a dedicated data-protection law.

   ANTIC (National ICT Agency)

6. 27 Feb 2013Law
   Decree No. 2013/0399/PM, Consumer Protection Rules for Electronic Communications

   The Prime Minister's decree laid down detailed implementation rules for protecting consumers of electronic communications services, including data-retention obligations and confidentiality requirements, supplementing the 2010 electronic-communications law.

   DataGuidance

7. 21 Dec 2010Law · official
   Law No. 2010/012 on Cybersecurity and Cybercrime, first data-privacy provisions

   Cameroon's foundational cybersecurity statute criminalised unauthorised access, data manipulation, identity theft, and interception of private communications. It imposed a 10-year connection-data retention obligation on operators and assigned ANTIC as national regulator, constituting the first meaningful legal protection for personal data in Cameroon.

   Ministry of Posts and Telecommunications (Cameroon)

Sources

1. 1.prc.cm/en/multimedia/documents/10271-law-n-2024-017-of-23-12-2024-web
2. 2.dataguidance.com/notes/cameroon-data-protection-overview
3. 3.lexafrica.com/2025/10/cameroon-data-protection-law-compliance/
4. 4.africanlawbusiness.com/expert-views/key-features-of-cameroons-new-data-protection-law/
5. 5.pollicy.medium.com/key-features-of-law-2024-017-on-personal-data-protection-in-cameroon-
6. 6.techhiveadvisory.africa/insights/operationalising-cameroons-data-protection-law-a-review-of-k
7. 7.paradigmhq.org/cameroon-joins-the-data-protection-race-who-holds-the-reins/
8. 8.clgglobal.com/understanding-cameroons-personal-data-protection-act-opportunities-ch
9. 9.kinsmenadvocates.com/cybersecurity/data-protection-in-cameroon-2025/