Cameroon

Cameroon's data protection landscape is in transition between two instruments. For over a decade, personal data protection sat incidentally within Law No. 2010/012 of 21 December 2010 on Cybersecurity and Cybercriminality, a cybersecurity-focused statute that obliged electronic communications operators to protect users' personal data, mandated ten-year retention of connection and traffic data, criminalised identity theft and unlawful interception, and designated the Agence Nationale des Technologies de l'Information et de la Communication (ANTIC) as the cybersecurity regulator. That law established no standalone data protection regime and no dedicated authority. That changed with Law No. 2024/017 of 23 December 2024 on Personal Data Protection, Cameroon's first comprehensive, dedicated data protection statute, which over time supersedes the data protection provisions embedded in the 2010 law. The 2024 Act applies to processing carried out in Cameroon and to processing directed at persons in Cameroon, with an unusually broad reach extending even to individuals in transit. It sets consent as the primary lawful basis (opt-in, specific, informed, freely given), recognises alternative bases, imposes the full set of principles (lawfulness, fairness, transparency, purpose limitation, minimisation, accuracy, storage limitation, security), and grants rights of access, rectification, erasure, and objection. Sensitive categories, including racial, ethnic, linguistic or regional origin, political opinions, religious beliefs, genetic, biometric, and health data, and sexual orientation, attract strict controls. The key institutional gap is enforcement. The 2024 Act provides for an independent Personal Data Protection Authority whose composition is to be set by Presidential decree; as at enactment that authority had not been constituted, leaving ANTIC as the only authority currently on file. Controllers were given an 18-month compliance grace period ending 23 June 2026. With two instruments documented and a named regulator, Cameroon is comparatively well-covered, but the dedicated data protection authority's actual establishment is the decisive outstanding step.