{
 "jurisdiction_id": "CM",
 "jurisdiction": "Cameroon",
 "url": "https://dataprotection.gi/jurisdictions/cameroon/",
 "generator": "render_jid v13-gdpri-1.0.0",
 "date_modified": "2026-08-05",
 "schema_version": "gdpri-v2",
 "counts": {
  "categories": 10,
  "claims": 8,
  "sub_modules": 57,
  "source_register": 22
 },
 "categories": [
  {
   "code": "regulator_and_framework",
   "name": "Regulator & Framework",
   "traffic_light": "amber",
   "sub_modules": [
    "act_and_instruments",
    "material_scope",
    "regulator_and_authority",
    "regulator_registration_and_filing",
    "territorial_scope"
   ],
   "url": "https://dataprotection.gi/jurisdictions/cameroon/#regulator-and-framework-regulator-framework",
   "traffic_light_rationale": "A comprehensive statute appears to have been adopted in H2 2024 per secondary sources, but the exact promulgation number, gazette citation, and confirmation that the new Data Protection Authority is operationally staffed and receiving filings were not found in available research.",
   "claims": [
    {
     "statement": "Cameroon's data protection law provides for the establishment of a National Authority for the Protection of Personal Data responsible for protecting the rights and freedoms of natural persons regarding the processing of their personal data.",
     "regulatory_stage": "enacted_not_yet_effective",
     "is_binding": true,
     "confidence": "Probable",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://www.dataguidance.com/news/cameroon-ministry-requests-comments-draft-law-data",
     "source_tier": null,
     "observed_at": null
    },
    {
     "statement": "Cameroon adopted a new comprehensive data privacy law in the second half of 2024.",
     "regulatory_stage": "enacted_not_yet_effective",
     "is_binding": true,
     "confidence": "Probable",
     "source_publisher": "IAPP",
     "source_url": "https://iapp.org/news/a/data-protection-and-privacy-laws-now-in-effect-in-144-countries",
     "source_tier": null,
     "observed_at": null
    },
    {
     "statement": "Cameroon's Law No. 2010/012 of 21 December 2010 relates to cybersecurity and cybercriminality and pre-dates the dedicated 2024 data protection statute.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Uncertain",
     "source_publisher": "OneTrust DataGuidance (legal research repository)",
     "source_url": "https://www.dataguidance.com/legal-research/law-no-2010012-21-december-2010-relating-cybersecurity-and-cybercriminality-cameroon",
     "source_tier": null,
     "observed_at": null
    },
    {
     "statement": "The Cameroon data protection law's definitional framework covers personal data, biometric data, genetic data, sensitive data, data subject, controller, processor, processing, personal data breach, and standard contractual clauses.",
     "regulatory_stage": "enacted_not_yet_effective",
     "is_binding": true,
     "confidence": "Probable",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://www.dataguidance.com/news/cameroon-ministry-requests-comments-draft-law-data",
     "source_tier": null,
     "observed_at": null
    },
    {
     "statement": "The law's territorial reach covers processing of personal data of individuals residing in Cameroon, processing by subcontractors not established in Cameroon where the controller is established there, and processing of Cameroonian nationals' data where Cameroonian law applies under international law.",
     "regulatory_stage": "enacted_not_yet_effective",
     "is_binding": true,
     "confidence": "Probable",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://www.dataguidance.com/news/cameroon-ministry-requests-comments-draft-law-data",
     "source_tier": null,
     "observed_at": null
    }
   ]
  },
  {
   "code": "lawful_processing_and_special_data",
   "name": "Lawful Processing & Special Data",
   "traffic_light": "amber",
   "sub_modules": [
    "consent_thresholds",
    "lawful_bases",
    "pseudonymisation_and_anonymisation",
    "special_categories"
   ],
   "url": "https://dataprotection.gi/jurisdictions/cameroon/#lawful-processing-and-special-data-lawful-processing-special-data",
   "traffic_light_rationale": "Special-category definitions are evidenced from the 2023 draft-law consultation summary; lawful bases, consent standards, and anonymisation rules are unconfirmed.",
   "claims": [
    {
     "statement": "Cameroon's data protection law defines 'biometric data,' 'genetic data,' and 'sensitive data' as distinct categories subject to specific rules.",
     "regulatory_stage": "enacted_not_yet_effective",
     "is_binding": true,
     "confidence": "Probable",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://www.dataguidance.com/news/cameroon-ministry-requests-comments-draft-law-data",
     "source_tier": null,
     "observed_at": null
    }
   ]
  },
  {
   "code": "data_subject_rights",
   "name": "Data Subject Rights",
   "traffic_light": "red",
   "sub_modules": [
    "access_right",
    "data_portability",
    "deadlines_and_response_windows",
    "rectification_and_erasure",
    "restriction_and_objection"
   ],
   "url": "https://dataprotection.gi/jurisdictions/cameroon/#data-subject-rights-data-subject-rights",
   "traffic_light_rationale": "No sub-module could be populated beyond a generic reference to rights protection; specific rights and deadlines are unconfirmed.",
   "claims": []
  },
  {
   "code": "controller_processor_duties",
   "name": "Controller/Processor Duties",
   "traffic_light": "amber",
   "sub_modules": [
    "accountability_and_dpia",
    "breach_notification",
    "dpo_requirements",
    "joint_controller_arrangements",
    "retention_and_disposal",
    "ropa_requirements",
    "security_measures"
   ],
   "url": "https://dataprotection.gi/jurisdictions/cameroon/#controller-processor-duties-controller-processor-duties",
   "traffic_light_rationale": "Accountability principles are evidenced from the 2023 draft-law summary; DPIA triggers, DPO thresholds, ROPA, breach notification specifics and retention rules are unconfirmed.",
   "claims": [
    {
     "statement": "Cameroon's data protection law sets out principles for processing personal data including purpose limitation, retention limitation, transparency, confidentiality, accessibility, and appropriate technical and organizational measures to guarantee a level of security appropriate to the risk of the processing.",
     "regulatory_stage": "enacted_not_yet_effective",
     "is_binding": true,
     "confidence": "Probable",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://www.dataguidance.com/news/cameroon-ministry-requests-comments-draft-law-data",
     "source_tier": null,
     "observed_at": null
    }
   ]
  },
  {
   "code": "cross_border_and_adequacy",
   "name": "Cross-Border & Adequacy",
   "traffic_light": "amber",
   "sub_modules": [
    "adequacy_granted",
    "adequacy_received",
    "data_localisation",
    "sccs_and_bcrs",
    "transfer_impact_assessment",
    "transfer_mechanisms"
   ],
   "url": "https://dataprotection.gi/jurisdictions/cameroon/#cross-border-and-adequacy-cross-border-adequacy",
   "traffic_light_rationale": "SCC/BCR transfer mechanisms are evidenced from the 2023 draft-law summary; adequacy status and localisation rules are unconfirmed.",
   "claims": [
    {
     "statement": "Cameroon's data protection law provides for cross-border transfer via standard contractual clauses approved by the Data Protection Authority, signed between the exporting entity and the third-party importer, and via binding corporate rules adopted by the importing entity.",
     "regulatory_stage": "enacted_not_yet_effective",
     "is_binding": true,
     "confidence": "Probable",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://www.dataguidance.com/news/cameroon-ministry-requests-comments-draft-law-data",
     "source_tier": null,
     "observed_at": null
    }
   ]
  },
  {
   "code": "sectoral_watch",
   "name": "Sectoral Watch",
   "traffic_light": "red",
   "sub_modules": [
    "credit_and_scoring",
    "education",
    "employment_data",
    "financial_sector_overlay",
    "health_sector_overlay",
    "insurance",
    "telecoms_and_eprivacy"
   ],
   "url": "https://dataprotection.gi/jurisdictions/cameroon/#sectoral-watch-sectoral-watch",
   "traffic_light_rationale": "Absence of sectoral overlay evidence.",
   "claims": []
  },
  {
   "code": "adtech_and_commercial_privacy",
   "name": "AdTech & Commercial Privacy",
   "traffic_light": "red",
   "sub_modules": [
    "clean_rooms_and_dcr",
    "cookies_and_trackers",
    "cross_context_advertising",
    "dark_patterns",
    "direct_marketing",
    "opt_out_signals"
   ],
   "url": "https://dataprotection.gi/jurisdictions/cameroon/#adtech-and-commercial-privacy-adtech-commercial-privacy",
   "traffic_light_rationale": "No adtech-specific evidence located.",
   "claims": []
  },
  {
   "code": "algorithmic_biometric_and_surveillance_governance",
   "name": "Algorithmic, Biometric & Surveillance Governance",
   "traffic_light": "amber",
   "sub_modules": [
    "ai_risk_assessments",
    "automated_decision_making_transparency",
    "biometric_regime",
    "genetic_data",
    "profiling_restrictions",
    "state_surveillance_carveouts"
   ],
   "url": "https://dataprotection.gi/jurisdictions/cameroon/#algorithmic-biometric-and-surveillance-governance-algorithmic-biometric-surveill",
   "traffic_light_rationale": "Only definitional evidence for biometric/genetic data was found; substantive governance provisions unconfirmed.",
   "claims": []
  },
  {
   "code": "children_and_vulnerable_groups",
   "name": "Children & Vulnerable Groups",
   "traffic_light": "red",
   "sub_modules": [
    "age_verification",
    "dependent_adults",
    "education_settings",
    "minor_profiling_bans",
    "parental_consent"
   ],
   "url": "https://dataprotection.gi/jurisdictions/cameroon/#children-and-vulnerable-groups-children-vulnerable-groups",
   "traffic_light_rationale": "No children/vulnerable-groups-specific evidence located.",
   "claims": []
  },
  {
   "code": "enforcement_and_redress",
   "name": "Enforcement & Redress",
   "traffic_light": "amber",
   "sub_modules": [
    "collective_redress_and_class_actions",
    "enforcement_activity_index",
    "private_right_of_action",
    "recent_developments_180d",
    "regulator_funding_and_capacity",
    "regulator_powers_and_penalties"
   ],
   "url": "https://dataprotection.gi/jurisdictions/cameroon/#enforcement-and-redress-enforcement-redress",
   "traffic_light_rationale": "Recent legislative development is evidenced; substantive enforcement powers/penalties and enforcement track record are unconfirmed.",
   "claims": []
  }
 ]
}