Cameroon. Comprehensive data protection. Law

Law 2024/017Law No. 2024/017 of 23 December 2024 on the protection of personal data

In force

Partly verified

Medium confidence. Exact in-force date not verified; compliance deadline 2026-06-23 now passed.

§1Summary

Synopsis

Cameroon's first comprehensive data protection law, replacing patchy sectoral rules. It introduces rights, controller duties, breach notification and a prior-authorisation regime overseen by a future independent authority.

Key themes

prior authorisation
breach notification
cross-border transfer authorisation
criminal penalties

Unique features

Processing and transfers abroad require prior authorisation; breaches must be reported immediately to the authority and data subjects regardless of severity.

SaaS relevance

Once the authority is set up, offshore SaaS processing Cameroonian data will need transfer authorisation; the law is described as non-extraterritorial.

§2Obligations

Extraterritorial: No
Breach notification: Authority and data subjects immediately
DPO: No
Cross-border transfers: Prior authority authorisation (adequacy, binding instrument or SCCs)
Maximum penalty: XAF 100m and/or up to 10 years' imprisonment

§3Dates

Key dates

Adopted 23 December 2024
In force 23 December 2024
18-month compliance period to 2026-06-23; implementing decree and authority decree pending

§4Text and authority

Text: No authoritative text located.
Authority: Not yet established (Personal Data Protection Authority provided for)

§5Where it applies

Domestic law of: Cameroon

§6Sources and verification

Verification

Medium confidence.

Partly verified

Medium confidence. Exact in-force date not verified; compliance deadline 2026-06-23 now passed.