Introduction
Businesses operating in Cameroon increasingly process personal data — customer records, employee files, KYC documentation for banks, health and biometric data. Unlike the EU or much of West Africa, Cameroon has not yet adopted a single comprehensive data protection statute; instead, personal data is regulated primarily through Law No. 2010/012 of 21 December 2010 relating to cybersecurity and cybercriminality, together with sectoral rules.
The current legal framework
Law No. 2010/012 criminalises unauthorised processing, alteration and disclosure of personal data and creates offences for fraudulent access to data systems. Sectoral regimes add obligations on top: banking data is supervised under COBAC rules, telecommunications operators under the framework administered by the national telecommunications regulator, and customer due diligence data under anti-money-laundering legislation. A dedicated data protection authority has been the subject of repeated reform proposals — the framework continues to evolve, and businesses should monitor developments.
What businesses should do in practice
For companies operating across borders — particularly those subject to the GDPR in their European operations — the pragmatic approach is to apply GDPR-grade standards to Cameroonian data processing: lawful bases for processing, documented consent where required, purpose limitation, data subject access procedures, security measures and incident response plans. Cross-border transfers of personal data out of Cameroon should be structured contractually and routed in compliance with CEMAC exchange-control documentation requirements where they intersect.
Relationship with the GDPR
Cameroonian companies with EU customers or establishment in the EU may fall directly within the GDPR’s extraterritorial scope. In practice, a single compliance programme built to GDPR standards, mapped against Cameroonian criminal and sectoral rules, is the most efficient structure for most groups.
Conclusion
Cameroon’s data protection landscape is patchwork rather than comprehensive — but the criminal exposure under Law No. 2010/012 is real, and the direction of reform is towards stronger protection. ALPs advises businesses on data compliance programmes for Cameroon and the CEMAC region.
