Cybersecurity in Cameroon: law and institutions

The shape of the landscape

Cybersecurity in Cameroon is governed by a legal framework that is older than the country's digital economy and enforced by an institutional framework that is unusually concentrated. The foundational text — Law No. 2010/012 of 21 December 2010 relating to cybersecurity and cybercriminality — has been in force for fifteen years; the agency it empowers, ANTIC, holds the security-regulation mandate, the national incident-response team, and the root of the country's electronic-certification hierarchy at once; and since December 2024, a general personal-data-protection law has been layered on top. This page maps that landscape: the laws as they are written, the institutions as they are empowered, and the threat picture as far as it can honestly be cited.

One rule governs the page. Every external fact — a law's number and date, an institution's mandate, a statistic — is carried with a citation to a primary or authoritative source, and claims that could not be verified against such a source were dropped rather than hedged. Where the record is thin, the page says so.

The legal framework

The cornerstone is Law No. 2010/012 of 21 December 2010. Its first section states its scope plainly: the law "governs the security framework of electronic communication networks and information systems, defines and punishes offences related to the use of information and communication technologies in Cameroon". Its stated aims are to build trust in networks and information systems; to establish the legal regime of digital evidence, security, cryptography, and electronic certification; and to protect the rights to human dignity, honour, and privacy, along with the legitimate interests of corporate bodies. One boundary is drawn at the outset: the law does not cover applications specific to national defence and security, which remain governed by their own texts.

The security half of the law is institutional. Section 7 places the regulation, control, and monitoring of activities related to the security of electronic communication networks, information systems, and electronic certification — "on behalf of the State" — in the hands of the National Agency for Information and Communication Technologies (ANTIC), acting in collaboration with the Telecommunications Regulatory Board. Section 8 makes ANTIC the Root Certification Authority and the certification authority of the public administration. And Section 32 subjects networks and information systems to "compulsory and periodic auditing of their security systems" by the agency — each year, or as circumstances require — with audit reports kept confidential and addressed to the minister in charge of telecommunications.

The criminal half is substantive and procedural at once. Part III opens with procedural provisions: criminal investigation officers with general jurisdiction and sworn, authorized ANTIC officials conduct the investigations. The offence catalogue then attaches real penalties to defined conduct — fraudulent access to a network or information system that disrupts its functioning, for example, carries five to ten years' imprisonment, a fine of ten to fifty million CFA francs, or both, with the penalties doubled where data is deleted or altered (Section 68). Part IV, Sections 90 to 94, turns to international cooperation and mutual judicial assistance in cybercrime matters, with a safeguard where enforcement could breach public order or the essential interests of the Nation; only transitional and final provisions follow.

The cybersecurity law does not stand alone. It was enacted the same day as Law No. 2010/013 of 21 December 2010 governing electronic communications — the companion text that organizes the sector itself, and the law under which ANTIC is instituted, as Law No. 2010/012 itself records. Sector regulation belongs to the Telecommunications Regulatory Board (ART), which oversees operators, spectrum, universal service, and quality of service. The two mandates are designed to interlock: ART regulates the networks, ANTIC their security.

The newest layer is Law No. 2024/017 of 23 December 2024 relating to personal data protection — Cameroon's first general data-protection law. It applies to the personal data of persons established, residing, or in transit in Cameroon, and it provides for a Data Protection Authority through which processing on Cameroonian territory and transfers abroad require prior authorization; the texts organizing that authority are still awaited. Legal analysis of the law reported a compliance deadline of 23 June 2026 for organizations to align their data-processing practices with its requirements — a window that closed before this page was published.

The institutional map

Read together, the three laws distribute cybersecurity authority across a small number of institutions. The map is compact enough to hold in one table — and worth holding, because in practice the question "who do we answer to?" has a different answer for a network operator, a data controller, and a crime victim.

One row deserves expansion. ANTIC discharges its security-intelligence mission through a national Computer Incident Response Team, whose functions the agency itself lists: real-time surveillance of sensitive national cyberspace infrastructure, security alerts and bulletins, public awareness, assistance to individuals and businesses, development of security standards, and technical support to law-enforcement investigations. The same page records a duty many organizations discover late: under Article 7 of Decree No. 2012/1643/PM, as ANTIC states it, any private or public agency is required to notify ANTIC of any computer-security incident affecting its network.

The threat picture, in citable figures

Threat statistics for Cameroon are scarce, and much of what circulates cannot be traced to a source. What can be cited comes principally from ANTIC's own published figures, relayed by the business press; they are presented here as what they are — the enforcement agency's numbers, not independently audited measurements.

For 2021, ANTIC put Cameroon's cybercrime losses at XAF 12.2 billion — nearly double the 2019 figure — of which XAF 2.5 billion was attributed to intrusions into public and private IT systems, XAF 6 billion to scamming and phishing, and XAF 3.7 billion to skimming, the copying of bank-card data at ATMs, according to figures relayed by Business in Cameroon. The same report records that close to XAF 6 billion was lost to bank fraud in 2019, with business-email compromise the dominant method, and that an ANTIC audit detected 27,052 vulnerabilities in the IT systems of public and private administrations in 2021.

The response is institutionalizing. On 20 January 2026 in Yaoundé, the national CIRT received equipment — servers, investigation platforms, vulnerability-scanning and penetration-testing tools — valued at over XAF 735 million, acquired under PATNUC, the World Bank-supported project for the acceleration of Cameroon's digital transformation, as reported by TechAfrica News. The same report carries the agency's activity figures: 32,500 legal requisitions processed in 2025, a 30 per cent increase over 2024; around 200 gigabytes of data analysed per day; and 8,502 vulnerabilities identified since January 2024 through audits and scans of public and private entities.

The gaps matter as much as the figures. There is no published national incident-notification dataset, the loss figures are not independently verified, and no standalone national cybersecurity strategy could be verified in primary sources at the time of writing — so this page cites none. What the verifiable record shows is a pressure curve bending upward and a response that is organizing itself, which is exactly why the obligations in the next section are worth taking literally.

What cybersecurity in Cameroon asks of an institution

Distilled, the landscape asks four things of an institution operating in Cameroon. First, expect the audit: Section 32 of Law No. 2010/012 makes security auditing compulsory and periodic, not optional and exceptional. Second, report the incident: ANTIC states that Article 7 of Decree No. 2012/1643/PM obliges every public or private agency to notify it of computer-security incidents affecting its network. Third, mind the clock that has already struck: legal analyses reported a compliance deadline of 23 June 2026 for organizations to align their processing — that window has now closed, and processing that is not yet aligned is already exposed. Fourth, treat evidence as a first-class object — the 2010 law made digital evidence a legal regime, and an institution that cannot produce trustworthy records is exposed in both directions, as a victim and as a defendant.

This page is deliberately a map, not a playbook. What these obligations mean operationally — scoping an audit, choosing controls, addressing the now-expired data-protection compliance deadline — is the subject of our practical guide to cybersecurity for organizations in Cameroon. The discipline that runs beneath it — authorization before capability, and evidence for every consequential action — is set out on governed cybersecurity. And for institutions in the Southwest, cybersecurity in Buea grounds the same questions locally.

Terms used on this page — from certification authority to incident response — are defined in plain language in the glossary.

Where SIGIL sits

SIGIL SARL is a Cameroonian company, founded in 2023 and based in Buea (RCCM RC.BUA.2026.B.0190), that builds governance infrastructure for public institutions. In this landscape its relevant system is VIGIL, a governed cybersecurity and evidence platform for duly authorized operators, built to OWASP, MITRE ATT&CK, and NIST 800-115 discipline, in which a technical capability is never an authorization and no finding is trusted until an independent, re-verifiable check confirms it. VIGIL is pre-deployment: SIGIL has no customers, deployments, pilots, or partnerships to cite, and this page cites none. Its source code is kept strictly private. The engineering method behind it is documented in the doctrine, and the wider compliance landscape it serves is mapped on regtech in Cameroon. Institutions that wish to examine the architecture can write to info@sigilsovereign.com.

Frequently asked

Request a briefing →

Related reading