CameroonLoi n°2024/017 du 23 décembre 2024 relative à la protection des données à caractère personnel au Cameroun
Loi n°2024/017 du 23 décembre 2024
In force.
A comprehensive regime rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Data subject residence, User location
- Obligation class
- Consent, Data subject rights, Biometric, Transfer, Breach notice, Governance, Licensing
- Audit expectation
- on_request
What it requires
- Obtain the data protection authority's prior authorization before processing personal data (Article 19).
- Obtain the data subject's prior, free, informed, specific, and unequivocal consent before processing personal data, unless the processing is necessary to meet a legal obligation, to perform a public-interest mission, or to preserve a person's health (Article 9).
- Obtain the backing of a parent or legal representative for the consent of a person under 18 (Article 9).
- Do not process data on religious, philosophical, political, or trade-union opinions or activities, racial, ethnic, linguistic, or regional origin, sexual life, or genetic or biometric data in matters of health, and do not process personal data in banking transactions without the competent administrations' prior authorization (Article 48).
- Keep a physical or digital register of processing activities that records the controller's name and contact details, the purposes, the categories of persons and data, the categories of recipients, and the documents attesting to the guarantees or the authorization number (Article 29).
- Inform the data protection authority and the data subject without delay on learning of a personal-data breach, and send the authority an annual report on the security measures implemented (Articles 22 and 27).
- Obtain the authority's prior authorization before transferring personal data to a foreign state or an international organization (Article 32).
These lines are LexLint's reading of the law's text.
Who enforces it
Settledness
- As of
- Open questions
- Does the prior authorization duty in Article 19 of Loi n°2024/017 bind a controller before the decree contemplated by Article 53 has created the data protection authority and named a body that can grant the authorization?
- Do the duties of Loi n°2024/017 bind from its promulgation on , given that it names no day of entry into force, or only from the end of the eighteen-month compliance period in Article 73?
What it makes you log
Who may demand the log
Regulator
What the log must hold
Event time, Actor identity, Access record, Data lineage
Logging duty
Article 29 makes a controller or processor keep a physical or digital register of the processing activities carried out under its responsibility, listing the controller's name and contact details, the purposes, the categories of persons and data, the categories of recipients, and the documents attesting to the safeguards or the number of the authority's authorization. Article 27(1) requires a controller or processor to guarantee that the identity of the people who have access to the information system, the nature of the data entered, modified, altered, copied, erased or read, and the period of handling can be verified and established after the fact. Article 27(1) does not use the word log; its duty is framed as after-the-fact verification. The items Article 29 lists describe the processing as a whole, not individual events. Article 22(1) separately requires the controller or processor to inform the authority and the data subject without delay on learning of a breach; that is a notification and the law names no breach register. Article 27(2) requires the controller to send the authority an annual report on how far the security measures have been implemented, which is the controller's own report. The law sets no period for keeping the register or the access trace.
- Kind
- Explicit
- As of
- Provision
- Loi n°2024/017, Article 29 (register of processing activities), with Article 27(1) (after-the-fact traceability of who accessed the information system and what data were entered, changed, copied, erased or read)
- Trigger
- personal_data_processing
What this law does
Cameroon's personal-data protection statute, promulgated on .
It governs any processing of personal data carried out by the State, the decentralized territorial authorities, or any other natural or legal person, and it reaches the data of any person established, resident, or in transit in Cameroon, processing by a controller or processor established in Cameroon, and processing carried out in a territory where Cameroonian law applies under international law or a duly ratified convention (Article 2).
Processing is subject to the data subject's prior, free, informed, specific, and unequivocal consent, with exceptions where it is necessary to meet a legal obligation, to perform a public-interest mission, or to preserve a person's health (Article 9). The consent of a person under 18 is valid only if backed by that of a parent or legal representative (Article 9).
Article 48 prohibits processing data on religious, philosophical, political, or trade-union opinions and activities, racial, ethnic, linguistic, or regional origin, sexual life, and genetic or biometric data in matters of health, and bars processing in banking transactions without the competent administrations' prior authorization.
Any processing is subject to prior authorization from the data protection authority (Article 19), and a controller or processor keeps a register of processing activities (Article 29). On learning of a breach, a controller or processor informs the authority and the data subject without delay (Article 22), and the controller sends the authority an annual report on the security measures it has implemented (Article 27).
The law describes an independent public data protection authority and leaves its creation, organization, and functioning to a decree of the President of the Republic (Article 53).
A transfer to a foreign state or an international organization needs the authority's prior authorization, and before granting it the authority must check a sufficient level of protection at the destination, a signed legal instrument with the destination state, binding security rules for the importing entity, and standard contractual clauses signed by the importing and exporting entities (Article 32).
The law closes with an execution formula and states no day on which it comes into force; it was promulgated on , and Article 73 gives a person processing personal data eighteen months from promulgation, that is until , to comply.
When LexLint raises it
When your app profile says your app processes biometric data, serves under-18s or processes personal data.
Back to the example · Lint your app
Page updated .