Loading...
Copyright © 2026 Anove International B.V.
All product names, logos, and brands are property of their respective owners. Use of these names does not imply affiliation, endorsement, or partnership.
Loading...
Copyright © 2026 Anove International B.V.
All product names, logos, and brands are property of their respective owners. Use of these names does not imply affiliation, endorsement, or partnership.
Law 2024/017
Law No. 2024/017 of 23 December 2024 is Cameroon's first dedicated data protection law, establishing a complete framework for the collection, processing and storage of personal data. Organisations must comply by 23 June 2026.
Promulgated on 23 December 2024, Law No. 2024/017 on the protection of personal data is Cameroon's founding text in this field. It applies to any public or private organisation, and to professionals acting in their own name, that processes personal data of persons residing, established or in transit in Cameroon, whether the controller is established in Cameroon or targets Cameroonian residents from abroad. Processing rests on four legal bases (consent, legal obligation, public-interest mission, protection of health), with consent subject to strict validity conditions and parental consent required for minors under 18. Sensitive data (health, biometric, judicial, religious or political opinions, banking transactions, among others) is prohibited from processing in principle.
The law introduces a prior-authorisation regime: organisations must obtain authorisation from the data protection authority before any processing, keep a register of processing activities, carry out impact assessments for high-risk processing, notify data breaches without delay, contract with processors, and obtain authorisation before any international transfer. Article 73 gives organisations 18 months from promulgation, until 23 June 2026, to reach compliance. The organisation and functioning of the independent authority are to be set by presidential decree, and implementing regulations will specify practical arrangements.
Before any processing of personal data, organisations must obtain an authorisation issued by the data protection authority. Processing without prior authorisation is punishable by fines of FCFA 5 to 50 million.
Consent must be free, informed, specific, unambiguous and express, obtained before processing begins; for minors under 18 it must be accompanied by parental or legal-representative consent.
Every organisation must maintain a register of all its processing operations, covering purposes, data categories, recipients, international transfers, retention periods and security measures, available to the authority on request.
Data breaches must be notified to the authority without delay, with affected persons informed where their rights are at risk; an annual report on security measures must also be submitted to the authority.
Read more
Anove scans your stack against Law 2024/017 and 260+ other frameworks in minutes.
Any transfer of personal data to a foreign country or international organisation requires prior authorisation from the authority, which verifies that the destination offers an equivalent level of protection.