CameroonLoi n°2010/012 du 21 décembre 2010 relative à la cybersécurité et à la cybercriminalité au Cameroun, articles 68-69 (accès frauduleux)
Loi n°2010/012 du 21 décembre 2010, art. 68-69
In force.
A computer misuse rule binding public and private bodies.
- Obligation class
- Access restriction, Security
- Audit expectation
- none
What it requires
- Do not fraudulently access or remain within all or part of an electronic-communications network or information system, or transmit, damage, or cause a serious disruption or interruption of its functioning.
- Do not access, without right and in violation of a security measure, all or part of a network, information system, or terminal equipment connected to another information system, in order to obtain information or data.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
- NIST AI 600-1
- GAI-RISK-09Information Security
- GAI-RISK-12Value Chain and Component Integration
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI03Identity and Privilege Abuse
- MIT mitigations Draft
- FINOS AIGF
- AIR-PREV-018Agent Authority Least Privilege Framework
- AIR-PREV-023Agentic System Credential Protection Framework
- ETSI EN 304 223
- 5.1.2-6Access the AI system gets to other systems and data sources is minimal and risk assessed.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Criminal exposureYes
Criminal exposure note
Article 68 punishes fraudulent access to or continued presence within a network or information system that disrupts its functioning with five to ten years' imprisonment and a fine of 10,000,000 to 50,000,000 FCFA, doubled to a higher fine range where data is deleted, modified, or the system's operation is altered as a result. Article 69 punishes access without right and in violation of security measures, to obtain information or data, with five to ten years and a fine of 10,000,000 to 100,000,000 FCFA, the higher of the two tiers.
Penalty structure
Article 69 sets the higher of the two computer-misuse tiers: five to ten years' imprisonment and a fine of 10,000,000 to 100,000,000 FCFA (XAF) for accessing a network, system, or terminal equipment without right and in violation of security measures to obtain information or data. Article 68's tier is lower, 10,000,000 to 50,000,000 FCFA for fraudulent access or continued presence causing a disruption, doubled in currency terms where data is deleted or modified as a result, still below article 69's cap. Neither tier multiplies by a count of violations.
- Rule
- Fixed only
- As of
- Currency
- XAF
- Fixed cap
- 100,000,000
Who enforces it
Settledness
- As of
- Open questions
- Does reading data from a publicly accessible page amount to accessing 'sans droit, et en violation des mesures de sécurité' under article 69, where the operator has published only terms of use or a robots.txt instruction and set up no technical barrier?
What it makes you log
Logging duty
Articles 68 and 69 define the offences of fraudulent access to, or fraudulent persistence in, a network or information system (art. 68) and of access without right in violation of security measures to obtain data (art. 69), with their penalties. Neither imposes a duty to create, keep, produce or review a log or record. Any retention or traceability duties the Act places on operators sit in other articles this row does not cite. Neither article states a territorial test, so the hook is empty.
- Kind
- None
- As of
What this law does
Cameroon's primary computer-misuse provisions, sitting in the cybersecurity and cybercrime law's offences-and-sanctions chapter.
Article 68 punishes fraudulently accessing or remaining within all or part of an electronic-communications network or information system by transmitting, damaging, or causing a serious disruption or interruption of the system's or network's functioning, with five to ten years' imprisonment and a fine of 10,000,000 to 50,000,000 FCFA, doubled where data is deleted or modified or the system's functioning is altered as a result.
Article 69 punishes accessing without right, and in violation of security measures, all or part of a network, information system, or terminal equipment connected to another information system, in order to obtain information or data, with five to ten years and a fine of 10,000,000 to 100,000,000 FCFA, the highest fine tier in the law's offences chapter.
Neither article carries an exemption for a search engine, indexer, or host, and neither turns its authorization test on whether the page reached was itself publicly accessible; article 69's own text keys liability to a security-measure violation, which a page requiring no authentication and using no technical access control would not appear to trigger, though no reported Cameroonian decision confirms this reading against a scraper of public pages specifically.
Article 97 provides that the law is to be registered and published under the urgent procedure and then inserted in the Official Gazette in French and English. Under article 4 of Ordonnance n° 72-11 du 26 août 1972, a law published under the urgent procedure is made known to the population by all means, notably radio, and is executory immediately. The English text of the law is dated Yaoundé, . No source located states the day on which the law was made known to the public.
When LexLint raises it
When your app profile says your app crawls the web or trains models.
Back to the example · Lint your app
Page updated .