CameroonLoi n°2010/012 du 21 décembre 2010 relative à la cybersécurité et à la cybercriminalité au Cameroun, article 74 (atteinte à la vie privée et traitement illicite des données à caractère personnel)
Loi n°2010/012 du 21 décembre 2010, art. 74
In force.
An enforcement supervision rule binding public and private bodies.
- Obligation class
- Consent, Biometric, Retention, Security
- Audit expectation
- none
What it requires
- Do not record, fix, or transmit another person's private or confidential electronic data without their consent, and do not intercept personal data while it is in transit between information systems.NIST Privacy FrameworkCT.PO-P1
- Do not process personal data without complying with the prior declaration or authorization formalities the law requires before implementing the processing.NIST Privacy FrameworkGV.PO-P5
- Do not collect a person's nominative data by unlawful means in order to harm their privacy or standing.NIST Privacy FrameworkCT.PO-P1
- Do not put online, keep, or store, without the data subject's express agreement, nominative data revealing tribal origin, political or religious opinions, trade-union membership, or morals, and do not divert such data in the course of recording, filing, or transmitting it.NIST Privacy FrameworkCT.PO-P1
- Do not retain nominative or encrypted personal data beyond the legal duration stated in the request for opinion or prior declaration for the processing, and do not disclose nominative data in a way that harms the person it concerns.NIST Privacy FrameworkCT.DM-P5NIST Privacy FrameworkCT.PO-P1
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.DM-P5Data are destroyed according to policy.
- NIST CSF 2.0
- ID.AM-08Systems, hardware, software, services, and data are managed throughout their life cycles
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Criminal exposure note
Article 74 carries eight tiers of criminal penalty across its alinéas: one to two years' imprisonment and a 1,000,000 to 5,000,000 FCFA fine for unconsented recording or transmission of private data or interception of personal data in transit (alinéas 1-2); one to three years and 1,000,000 to 5,000,000 FCFA for processing without the required prior formalities (alinéa 3); six months to two years and 1,000,000 to 5,000,000 FCFA for unlawfully collecting nominative data to harm a person's privacy or standing (alinéa 4), doubled to one to four years and 2,000,000 to 10,000,000 FCFA for putting online or storing sensitive-category nominative data without express agreement, or diverting such data (alinéas 5-6); and six months to two years with the article's highest fine, 5,000,000 to 50,000,000 FCFA, for retaining data beyond its legal retention period or for a disclosure that harms the victim's standing (alinéas 7-8).
Penalty structure
Article 74(7)-(8) sets the article's highest fine tier, 5,000,000 to 50,000,000 FCFA (XAF), with a comparatively low six-months-to-two-years prison term, for retaining nominative or encrypted personal data beyond its stated legal retention period, or for a disclosure of nominative data that harms the person's standing. The article's other tiers are lower: 1,000,000 to 5,000,000 FCFA at alinéas 1-4, doubled to 2,000,000 to 10,000,000 FCFA at alinéas 5-6 for sensitive-category data put online or diverted without consent. None of the article's tiers multiply by violation count; each is a fixed range per offence.
- Rule
- Fixed only
- As of
- Currency
- XAF
- Fixed cap
- 50,000,000
Who enforces it
Settledness
- As of
- Open questions
- Do the 'formalités préalables à leur mise en œuvre' in article 74(3) now mean the prior formalities set by Loi n°2024/017 du 23 décembre 2024, and does article 74(3) continue to apply alongside that law?
What it makes you log
Logging duty
Article 74 is an offences provision. It punishes recording or transmitting private electronic data without consent (alinéa 1), intercepting personal data in transmission (alinéa 2), processing in breach of the prior formalities (alinéa 3), collecting nominative data by unlawful means (alinéas 4 to 6) and keeping nominative information beyond the legal period stated in the declaration (alinéa 7). None of these requires anyone to make, keep or produce a log or record, and the retention offence concerns the personal data, not a record. No audit, access party or retention period for a record is named, and the article carries no territorial clause, so the hook is empty.
- Kind
- None
- As of
What this law does
Article 74 of Cameroon's cybersecurity and cybercrime law, sitting in the law's own offences-and-sanctions chapter (Title III, Chapter II, Articles 60 to 89), criminalizes a range of personal-data misuse that predates and now sits alongside the 2024 comprehensive statute.
It punishes recording, fixing, or transmitting private or confidential electronic data without the data subject's consent, and intercepting personal data during its transmission between information systems, with one to two years' imprisonment and a fine of 1,000,000 to 5,000,000 FCFA (alinéas 1 and 2).
It separately punishes processing personal data in violation of the prior formalities required before implementation, with one to three years and a fine of 1,000,000 to 5,000,000 FCFA (alinéa 3), and collecting nominative data by unlawful means to harm a person's privacy or standing, with six months to two years and the same fine range (alinéa 4).
Those alinéa-4 penalties are doubled against a person who puts online, keeps, or stores in computerized memory, without the data subject's express agreement, nominative data revealing tribal origin, political or religious opinions, trade-union membership, or morals, and the doubled penalty also reaches a person who diverts such information in the course of recording, filing, or transmitting it (alinéas 5 and 6).
The highest fine in the article, 5,000,000 to 50,000,000 FCFA (with a lower six-months-to-two-years prison term), punishes retaining information in nominative or encrypted form beyond the legal duration stated in the request for opinion or prior declaration for the automated processing, and the same penalty reaches disclosing nominative data in a way that harms the victim's standing (alinéas 7 and 8). The law was promulgated on .
Its Article 97 orders its registration and publication under the urgent procedure and its insertion in the Journal Officiel in French and English without naming a day of entry into force.
When LexLint raises it
When your app profile says your app processes personal data or processes voice recordings.
Back to the example · Lint your app
Page updated .