Cameroon

Law No. 2024/017 of 23 December 2024 relating to Personal Data Protection IN FORCE

commenced 2024-12-23 (18-month grace expired 2026-06-23) · Official full text ↗

Scope

Processing of personal data in Cameroon or producing effects in Cameroon.

Key obligations

GDPR-adjacent: DPIAs, records of processing, portability; Declaration/authorisation formalities with the future authority

DPO required

Provided for in prescribed cases.

Registration

Formalities with the Personal Data Protection Authority once constituted.

Cross-border transfers

Every transfer to a foreign country or international organisation needs PRIOR AUTHORISATION of the Personal Data Protection Authority (s. 32(1)); the Authority verifies CUMULATIVELY that the destination is adequate, that a legal instrument with the destination country is in force, that the importing entity is subject to binding data-security rules, and that both parties comply with the Authority's published standard contractual clauses (s. 32(2)). No consent or necessity derogations. (Verified from the archived certified copy via Vision OCR 2026-07-11, S27.)

Breach notification

Notification obligations per the law.

Penalties

Administrative and criminal sanctions per the law.

Authority

Personal Data Protection Authority (composition awaited from the Presidency)

Verified 2026-07-06