Law No. 2024/017 of 23 December 2024 relating to Personal Data Protection

Law No. 2024/017 of 23 December 2024 on Personal Data Protection is Cameroon's first comprehensive and dedicated data protection statute. Enacted on 23 December 2024, it marks a significant shift from the fragmented, sector-based data protection provisions previously embedded in Law No. 2010/012 on Cybersecurity and Cybercrime, establishing a unified national framework aligned with international data privacy standards. Cameroon became the 38th African country to adopt such a law upon its enactment. The law applies to any processing of personal data carried out by a natural or legal person established in Cameroon, as well as to processing directed at individuals in Cameroon or relating to activities based in Cameroon. Its scope extends to individuals transiting through Cameroon, meaning persons passing through the country, irrespective of nationality or length of stay, may have their personal data protected under the law. Personal data is defined broadly to include any information relating to an identified or identifiable natural person. The law distinguishes between standard personal data and sensitive categories, the processing of which is subject to stricter controls. Sensitive categories include data revealing racial or ethnic origin, linguistic or regional origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, health data, and sexual orientation or sex life. The law establishes consent as the primary legal basis for data processing, requiring consent that is opt-in, freely given, specific, informed, and unambiguous. Alternative lawful bases include compliance with a legal obligation, the performance of a contract, the protection of vital interests, and the performance of a public interest task. Data controllers and processors must comply with principles of lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, and security. Data subjects are granted rights including rights of access, rectification, erasure, and objection to processing. The law establishes an independent Personal Data Protection Authority whose composition and internal structure are to be determined by Presidential decree. As at the enactment date, the authority had not been constituted. An 18-month grace period was granted for controllers and processors to bring operations into compliance, with the deadline falling on 23 June 2026. Original language: French and English (bilingual). Full text published at the Presidency of the Republic of Cameroon website.

1. 1Scope extends to all processing in Cameroon and to processing directed at persons in Cameroon, including persons in transit irrespective of nationality
2. 2Consent must be opt-in, specific, informed, and freely given; alternative lawful bases include legal obligation, contract performance, and public interest
3. 3Sensitive categories, including racial/ethnic origin, political opinions, religious beliefs, health data, biometric data, and sexual orientation, are subject to strict processing restrictions
4. 4Data subjects hold rights of access, rectification, erasure, and objection to processing
5. 5An independent Personal Data Protection Authority is established; composition to be set by Presidential decree, not yet constituted as at enactment
6. 6Controllers and processors have an 18-month compliance grace period ending 23 June 2026
7. 7Supersedes data protection provisions previously contained in Law No. 2010/012 of 2010 on Cybersecurity and Cybercrime (see cm-cyber-2010)