African Union. Comprehensive data protection. Treaty

Malabo ConventionAfrican Union Convention on Cyber Security and Personal Data Protection (Malabo Convention)

In force

Partly verified

Medium confidence. I could not get the current ratification count from the AU treaty status list; 16 was the figure as of mid-2024. The exact adoption date (27 June 2014) comes from established references.

§1Summary

Synopsis

A pan-African treaty covering electronic transactions, personal data protection and cybersecurity and cybercrime. Parties must adopt data protection laws with GDPR-like principles, independent national authorities and data subject rights, and must criminalise cyber offences.

Key themes

data protection principles
independent DPA
data subject rights
sensitive data
e-transactions
cybercrime

Unique features

It is the only binding pan-African data protection treaty, but few states have ratified it. It contains transfer restrictions to non-member states without adequate protection.

SaaS relevance

It does not directly bind companies; it underpins national laws in ratifying states.

§2Obligations

Cross-border transfers: Transfers to non-AU states only with adequate protection
Maximum penalty: Set by national law

§3Dates

Key dates

Adopted 27 June 2014
In force 8 June 2023
Adopted in Malabo in June 2014; entered into force 2023-06-08, 30 days after the 15th ratification (Mauritania); 16 ratifications recorded as of mid-2024

§4Text and authority

Text

Authoritative text au.int

Authority

National data protection authorities (to be set up by each party); AU Commission

§5Where it applies

Members of the body

Membership-based — check ratification status. Membership of African Union does not mean a state has signed or ratified this instrument.

§6Sources and verification

Sources consulted

Verification

Medium confidence.

Partly verified