Loi n°2024/017 du 23 décembre 2024 relative à la protection des données à caractère personnel au Cameroun
Loi n°2024/017 du 23 décembre 2024
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
Commencement not set.
A comprehensive regime rule binding public and private bodies.
As of 4 September 2026.
What it requires
- Obtain the data protection authority's prior authorization before processing personal data of a person established, resident, or in transit in Cameroon.
- Rely on a lawful basis, consent, a legal obligation, a public-interest mission, or health protection, before processing personal data, and where consent is the basis, make it free, informed, specific, unequivocal, and express.
- Obtain parental or legal-representative consent before processing the personal data of a person under 18.
- Do not process health data, biometric data, judicial data, or data revealing religious or political opinions or banking transactions, unless a lawful exception applies.
- Keep a register of processing activities covering purposes, data categories, recipients, international transfers, retention periods, and security measures, and make it available to the authority on request.
- Notify the data protection authority of a personal-data breach without delay, and inform an affected person where their rights are threatened; submit an annual security report to the authority.
- Obtain the authority's prior authorization before transferring personal data to a foreign country or an international organization, which the authority will grant only where the destination offers an equivalent level of protection.
What it reaches
Obligation class
Consent, Data subject rights, Biometric, Transfer, Breach notice, Governance, Licensing
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Cameroon's first comprehensive personal-data statute, promulgated on 23 December 2024. It governs processing of personal data by the State, decentralized territorial authorities, and any other natural or legal person. It reaches the data of any person established, resident, or in transit in Cameroon, whether the data controller is established in Cameroon or targets from abroad persons residing in Cameroon.
Processing needs a lawful basis: consent, a legal obligation, a public-interest mission, or health protection. Consent must be free, informed, specific, unequivocal, and express, and processing a minor's data additionally needs parental or legal-representative consent. Sensitive categories including health, biometric, and judicial data, and religious, political, and banking information, are in principle prohibited from processing.
The law requires prior authorization from the data protection authority before processing and a register of processing activities. It also requires breach notification to the authority without delay and to affected persons where their rights are threatened, plus an annual security report. The law creates an independent data protection authority whose organization and functioning is left to a presidential decree not yet issued.
A cross-border transfer needs the authority's prior authorization, conditioned on an equivalent level of protection at the destination. Existing processing operations were given an 18-month transitional period from promulgation, to 23 June 2026, to come into conformity.
When LexLint raises it
crawls_webtrains_modelsdeploys_chatbotautomated_outreachhigh_risk_decisionsprocesses_voiceprocesses_biometricsserves_minors
Read the law
Loi n°2024/017 du 23 décembre 2024, Presidency of the Republic of Cameroon gazette listing page
provisions summarized here are drawn from secondary legal commentary and a compliance tracker, not from a directly quoted primary text