Cameroon

Cameroon's personal-data protection statute, promulgated on 23 December 2024.

It governs any processing of personal data carried out by the State, the decentralized territorial authorities, or any other natural or legal person, and it reaches the data of any person established, resident, or in transit in Cameroon, processing by a controller or processor established in Cameroon, and processing carried out in a territory where Cameroonian law applies under international law or a duly ratified convention (Article 2).

Processing is subject to the data subject's prior, free, informed, specific, and unequivocal consent, with exceptions where it is necessary to meet a legal obligation, to perform a public-interest mission, or to preserve a person's health (Article 9). The consent of a person under 18 is valid only if backed by that of a parent or legal representative (Article 9).

Article 48 prohibits processing data on religious, philosophical, political, or trade-union opinions and activities, racial, ethnic, linguistic, or regional origin, sexual life, and genetic or biometric data in matters of health, and bars processing in banking transactions without the competent administrations' prior authorization.

Any processing is subject to prior authorization from the data protection authority (Article 19), and a controller or processor keeps a register of processing activities (Article 29). On learning of a breach, a controller or processor informs the authority and the data subject without delay (Article 22), and the controller sends the authority an annual report on the security measures it has implemented (Article 27).

The law describes an independent public data protection authority and leaves its creation, organization, and functioning to a decree of the President of the Republic (Article 53).

A transfer to a foreign state or an international organization needs the authority's prior authorization, and before granting it the authority must check a sufficient level of protection at the destination, a signed legal instrument with the destination state, binding security rules for the importing entity, and standard contractual clauses signed by the importing and exporting entities (Article 32).

The law closes with an execution formula and states no day on which it comes into force; it was promulgated on 23 December 2024, and Article 73 gives a person processing personal data eighteen months from promulgation, that is until 23 June 2026, to comply.

Article 74 of Cameroon's cybersecurity and cybercrime law, sitting in the law's own offences-and-sanctions chapter (Title III, Chapter II, Articles 60 to 89), criminalizes a range of personal-data misuse that predates and now sits alongside the 2024 comprehensive statute.

It punishes recording, fixing, or transmitting private or confidential electronic data without the data subject's consent, and intercepting personal data during its transmission between information systems, with one to two years' imprisonment and a fine of 1,000,000 to 5,000,000 FCFA (alinéas 1 and 2).

It separately punishes processing personal data in violation of the prior formalities required before implementation, with one to three years and a fine of 1,000,000 to 5,000,000 FCFA (alinéa 3), and collecting nominative data by unlawful means to harm a person's privacy or standing, with six months to two years and the same fine range (alinéa 4).

Those alinéa-4 penalties are doubled against a person who puts online, keeps, or stores in computerized memory, without the data subject's express agreement, nominative data revealing tribal origin, political or religious opinions, trade-union membership, or morals, and the doubled penalty also reaches a person who diverts such information in the course of recording, filing, or transmitting it (alinéas 5 and 6).

The highest fine in the article, 5,000,000 to 50,000,000 FCFA (with a lower six-months-to-two-years prison term), punishes retaining information in nominative or encrypted form beyond the legal duration stated in the request for opinion or prior declaration for the automated processing, and the same penalty reaches disclosing nominative data in a way that harms the victim's standing (alinéas 7 and 8). The law was promulgated on 21 December 2010.

Its Article 97 orders its registration and publication under the urgent procedure and its insertion in the Journal Officiel in French and English without naming a day of entry into force.

Cameroon's primary computer-misuse provisions, sitting in the cybersecurity and cybercrime law's offences-and-sanctions chapter.

Article 68 punishes fraudulently accessing or remaining within all or part of an electronic-communications network or information system by transmitting, damaging, or causing a serious disruption or interruption of the system's or network's functioning, with five to ten years' imprisonment and a fine of 10,000,000 to 50,000,000 FCFA, doubled where data is deleted or modified or the system's functioning is altered as a result.

Article 69 punishes accessing without right, and in violation of security measures, all or part of a network, information system, or terminal equipment connected to another information system, in order to obtain information or data, with five to ten years and a fine of 10,000,000 to 100,000,000 FCFA, the highest fine tier in the law's offences chapter.

Neither article carries an exemption for a search engine, indexer, or host, and neither turns its authorization test on whether the page reached was itself publicly accessible; article 69's own text keys liability to a security-measure violation, which a page requiring no authentication and using no technical access control would not appear to trigger, though no reported Cameroonian decision confirms this reading against a scraper of public pages specifically.

Article 97 provides that the law is to be registered and published under the urgent procedure and then inserted in the Official Gazette in French and English. Under article 4 of Ordonnance n° 72-11 du 26 août 1972, a law published under the urgent procedure is made known to the population by all means, notably radio, and is executory immediately. The English text of the law is dated Yaoundé, 21 December 2010. No source located states the day on which the law was made known to the public.

Loi n°2000/011 du 19 décembre 2000 relative au droit d'auteur et aux droits voisins defines a "base de données" (article 2, definitions no. 12) as a collection of works, data, or other elements systematized so as to be searchable and processed by computer, and protects, as an original composite work without prejudice to any copyright in the pre-existing work (article 4(2)(b)), collections of works, including collections of folklore expressions or of simple facts or data, such as encyclopedias, anthologies, and data compilations, whether reproduced on a machine-exploitable medium or in any other form, where the selection or arrangement of the material constitutes an original work; there is no separate sui generis database right.

The underlying facts and data within a database remain unprotected; only an original selection or arrangement is a protected work.

Infringement (contrefaçon), defined at article 80 to include any exploitation of a literary or artistic work in violation of the law by representation, reproduction, transformation, or distribution by any means, is punished under article 82 by five to ten years' imprisonment and a fine of 500,000 to 10,000,000 FCFA, or either penalty alone, doubled where the offender is the rightsholder's own co-contracting party. Loi n° 2000/011 is dated 19 December 2000.

Its last article, article 97, orders that the law be registered and published by the urgent procedure and then inserted in the Journal officiel. The law's final articles state no day of its own for its entry into force. Under article 4 of Ordonnance n° 72-11 du 26 août 1972, a law published by the urgent procedure is brought to the population's knowledge by all means, notably radio, and is executory immediately.

No record of the day on which the law was communicated under that procedure, and no issue of the Journal officiel carrying it, has been located.

Article 24 requires that the operators of electronic-communications networks and providers of electronic-communications services take all technical and administrative measures necessary to guarantee the security of the services offered, and separately requires them to inform their users of the dangers of using their networks, the specific security risks they face (distributed denial of service, abnormal rerouting, traffic spikes, unusual traffic and ports, passive and active eavesdropping, and intrusions), and the technical means available to secure their communications.

Article 26 separately binds any information-system operator, a term the law defines broadly as an isolated device or a group of interconnected devices carrying out automated data processing under a program, requiring it to adopt standardized systems that let it continuously identify, assess, treat, and manage the risks tied to its information systems' security within the services it offers directly or indirectly, and to put in place technical mechanisms against threats to its systems' permanent availability, integrity, authentication, non-repudiation, data confidentiality, and physical security.

The security mechanisms an information-system operator adopts for this purpose must be approved by Cameroon's National Information and Communication Technologies Agency (ANTIC), which the law calls the Agency, before they satisfy the duty. The same operators must evaluate and revise their security systems as technology evolves, introducing whatever changes their security practices, measures, and techniques need.

Beyond that self-implemented program, networks and information systems are subject to a mandatory, periodic security audit that the Agency itself conducts at least once a year or whenever circumstances require, with confidential audit reports going to the Minister in charge of Telecommunications.

Article 13 separately and expressly subjects the networks and information systems of operators, certification authorities, and providers of electronic-communications services to that same mandatory security audit.

Obstructing, resisting, or preventing that audit, or refusing to provide the information or documents it requires, is a criminal offense carrying one to five years' imprisonment and a fine of 100,000 to 1,000,000 FCFA, or either penalty alone, though no provision sets a distinct penalty for an operator's substantive failure to implement the underlying security measures themselves, beyond the Agency's power to withhold approval of a non-compliant mechanism.

Cameroon's charter for the protection of children online is Loi n°2023/009 of 25 July 2023. The charter applies to all activities involving children in cyberspace and defines a child as any person under 18 (Articles 2 and 3).

The private sector shares with the public authorities the task of making the national cyberspace safer for children, and is to take steps when offering services to reduce the availability of, and access to, content harming a child's dignity and integrity (Articles 11 and 12).

On the competent authorities' request, internet access providers, content providers, information-system operators, and social-network promoters must suspend access to the internet, to their content, or to their network for a consumer who published content harming a child's dignity and integrity, and search-engine providers must stop indexing such content (Articles 14 and 15).

Internet access providers, content and search-engine providers, social-network promoters, information-system operators, and cybercafe managers must also report to the competent authorities all acts constituting child pornography and suspend the sites identified as harming a child's dignity and integrity (Article 16).

Internet access providers must make available guides to good practice in cyberspace, reporting mechanisms, and parental-control tools, and content and online-service providers must describe the nature of their content or services and the age groups they are intended for (Articles 20, 21, and 23).

Online gambling and betting promoters who do not keep children out, by a visible text barring them, an honor declaration of age with identification data, and online payment, face one to three years' imprisonment, a fine of 5,000,000 to 10,000,000 FCFA, or both (Article 36).

When a provider breaches its duties, the body regulating information and communication technologies serves formal notice to comply within 15 days, and if the notice is ignored it imposes a penalty of 1,000,000 to 10,000,000 FCFA (Articles 28 and 29).

Criminal sanctions begin at Article 33, with a fine of 25,000,000 to 250,000,000 FCFA for an internet access provider that knows of content harming a child's dignity and integrity and does not report, block, or remove it, and the court may add professional prohibitions and temporary closure of the establishment on a repeat offence.

The law names no day of entry into force: its article 49 orders it registered and published under the urgent procedure and inserted in the Journal Officiel in French and English, and its article 48 leaves the detailed rules of application to separate texts.

Loi n°2000/011 du 19 décembre 2000 relative au droit d'auteur et aux droits voisins permits, once a work has been published with the author's authorization, analyses, press reviews, and short quotations justified by the critical, pedagogical, scientific, or informational character of the work, provided the source and the author's name (where it appears in the source) are indicated (article 29(1)(d)).

It separately permits reproducing and making accessible to the public, for informational purposes and in short excerpts, literary or artistic works seen, heard, or recorded in the course of a current event, by photography, broadcast, or another means of public communication, on the occasion of reporting that event (article 30).

It further permits the press or a broadcaster to reproduce, in original version or in translation, political, social, economic, or religious current-affairs articles, political speeches, speeches delivered in judicial proceedings, and sermons, conferences, and addresses of the same nature, unless the right of exploitation has been expressly reserved by the author or the copyright owner, always subject to clearly indicating the source and the author's name (article 31).

Neighbouring rights under the law protect only performers, producers of sound and video recordings, and audiovisual-communication enterprises, so a print or online news publisher holds no neighbouring right distinct from its ordinary copyright in the articles it publishes. No provision addresses hyperlinking, framing, or inline display, and no reported case law applies articles 29, 30, or 31 to a systematic aggregator rather than a traditional press or broadcast outlet.

Loi n° 2000/011 is dated 19 December 2000. Its last article, article 97, orders that the law be registered and published by the urgent procedure and then inserted in the Journal officiel. The law's final articles state no day of its own for its entry into force. Under article 4 of Ordonnance n° 72-11 du 26 août 1972, a law published by the urgent procedure is brought to the population's knowledge by all means, notably radio, and is executory immediately.

No record of the day on which the law was communicated under that procedure, and no issue of the Journal officiel carrying it, has been located.