Organisations operating across Africa face a patchwork of national cyber and data protection laws, and the African Union's Malabo Convention is the continental treaty many of those laws are built on. The African Union Convention on Cyber Security and Personal Data Protection was adopted in Malabo on 27 June 2014 and entered into force on 8 June 2023. This guide explains what the treaty requires of the states that ratify it, which states have done so (20 deposits on the AU status list dated 2 February 2026), how its obligations reach businesses through national law, and what that means for security, privacy and identity programmes. It is for CISOs, privacy officers, legal and compliance teams and executives with operations or customers in African markets. It complements the Budapest Convention and UN Cybercrime Convention Guide, which covers the other international cybercrime treaties.
Sources: signature, ratification and entry-into-force facts come from the African Union's own treaty page and status list (dated 2 February 2026). The official AU treaty PDF could not be read as text, so this page is based on secondary sources for the article wording: the Convention text published by TanzLII (AfricanLII network) and the copy hosted by Veritas Zimbabwe. Article-level statements below are attributed to those copies. Confirm against the official text before relying on it.
Key takeaways
- It binds states, not companies. The Convention obliges ratifying AU member states to pass laws and set up institutions; businesses feel it through the national laws that implement it.
- Three pillars in one treaty. Chapter I covers electronic transactions, Chapter II personal data protection, and Chapter III cyber security and cybercrime.
- In force since 8 June 2023. It took effect after the fifteenth instrument of ratification was deposited; the AU status list of 2 February 2026 shows 21 signatories and 20 ratifications deposited.
- Data protection looks familiar. Independent national authorities, lawful-basis and purpose principles, sensitive data rules, data subject rights, and security and confidentiality duties for controllers.
- Companies can be criminally liable. Article 30 asks states to make legal persons liable for offences committed on their behalf, and Article 31 to set effective penalties including fines for legal persons.
Scope: who and what is covered
The Convention is open to all African Union member states (Article 35). It applies to a state once that state has ratified or acceded and deposited its instrument with the Chairperson of the AU Commission. Within ratifying states, Chapter II applies to processing of personal data by individuals, the state and public and private organisations, with exclusions for purely personal or household activity and certain temporary technical copies (Article 9).
| Chapter | Articles | Subject | Who it reaches through national law |
|---|---|---|---|
| I Electronic transactions | 1-7 | E-commerce, electronic advertising, electronic contracts, electronic writing and signatures, security of electronic transactions | Online sellers, payment providers, any business contracting electronically |
| II Personal data protection | 8-23 | National authorities, processing formalities, principles, sensitive data, rights, controller obligations | Any public or private controller processing personal data |
| III Cyber security and cybercrime | 24-31 | National policy and strategy, legal measures, monitoring structures, CERTs and cooperation, offences and sanctions | Critical infrastructure operators, service providers, all organisations as potential victims or liable legal persons |
| IV Final provisions | 32-38 | AU follow-up mechanism, disputes, ratification, entry into force, amendment, depository | States and the AU Commission |
Ratifications
The AU status list dated 2 February 2026 records these 20 states as having ratified or acceded and deposited: Angola, Benin, Cape Verde, Congo, Côte d'Ivoire, Democratic Republic of Congo, Ghana, Guinea, Lesotho, Madagascar, Mauritania, Mauritius, Mozambique, Namibia, Niger, Rwanda, São Tomé and Príncipe, Senegal, Togo and Zambia. Mauritius (deposit 14 March 2018) and Senegal (16 August 2016) were among the earliest; Madagascar (deposit 15 September 2025) is the most recent on that list. Large economies such as Nigeria, Kenya, South Africa and Egypt do not appear in the deposit list, so their own national laws govern; see the Nigeria Data Protection Act Guide, Kenya Data Protection Act Guide and South Africa POPIA Guide. Always check the current AU status list before relying on a country's position.
Key obligations
Personal data protection (Chapter II)
Article summaries in this section follow the TanzLII and Veritas copies of the Convention text.
| Article | Obligation on the state (and, through national law, on controllers) |
|---|---|
| 8 | Set up a legal framework that protects privacy and personal data while allowing free flow of data |
| 10 | Processing formalities: some processing exempt, most requires a declaration to the authority, and sensitive categories such as biometrics and health research need prior authorisation |
| 11-12 | Create an independent national personal data protection authority with secrecy duties, adequate resources, powers to handle complaints, audit, authorise (including cross-border transfers), warn and sanction after a hearing, with decisions open to appeal |
| 13 | Principles: consent or another legal basis, lawfulness and fairness, purpose limitation, accuracy, transparency, confidentiality and security |
| 14 | Sensitive data (such as racial origin, religion, health, genetic data) generally prohibited with listed exceptions; limits on automated decisions with significant effects; transfers outside the AU only where adequate protection is ensured |
| 15 | Interconnection of files only for legitimate purposes, without discrimination and with appropriate security |
| 16-19 | Rights to information, access, objection, and rectification or erasure |
| 20-23 | Controller duties: confidentiality (authorised persons acting on instructions), security (precautions against alteration, destruction or unauthorised access), storage limitation, and sustainability (data remains usable despite technological change) |
Electronic transactions (Chapter I)
Chapter I is the least discussed part of the treaty but matters to any business selling online in a ratifying state. According to the TanzLII copy of the text, Article 2 requires e-commerce providers to disclose their identity, contact, registration, tax and licensing details and to state prices clearly. Article 4 requires online advertising to be identifiable and restricts unsolicited direct marketing. Article 5 sets rules for electronic contracts, including letting buyers verify an order before confirming it and acknowledging orders. Article 6 lets electronic documents satisfy written-form rules where the author is identifiable and integrity is preserved, and Article 7 treats electronic signatures created with secure devices as equivalent to handwritten ones.
Cyber security and cybercrime (Chapter III)
As set out in the TanzLII and Veritas copies:
- National framework (Article 24): each state develops a national cyber security policy covering critical information infrastructure and risks, and strategies to implement it.
- Legal measures (Article 25): criminalise attacks on ICT systems, designate institutions to respond to incidents, protect citizens' rights, and identify critical infrastructure sectors that attract stronger penalties.
- National system (Article 26): promote a security culture, government leadership, public-private partnerships, and education and training.
- Monitoring structures (Article 27): governance bodies with clear accountability and institutions to combat cybercrime, monitor incidents and coordinate nationally and internationally.
- Cooperation (Article 28): harmonise cybercrime laws, mutual legal assistance, and information-sharing bodies such as CERTs or CSIRTs.
- Offences (Article 29): unauthorised access to systems, data and system interference, computer-related fraud, child sexual abuse material, racist and xenophobic material, and processing personal data without the required formalities.
- Adapted offences and liability (Article 30): extend property offences to computer data, treat ICT use as aggravating, and make legal persons liable without excluding individual liability.
- Sanctions and procedure (Article 31): effective penalties including fines for legal persons, additional sanctions such as publication and confiscation, and investigative powers including preservation of data for up to two years.
Timeline and current status
| Date | Event |
|---|---|
| 27 June 2014 | Adopted at the 23rd Ordinary Session of the AU Assembly in Malabo, Equatorial Guinea |
| 16 August 2016 | Senegal deposits its instrument (earliest deposit on the status list) |
| 11 May 2020 | Date of last signature shown on the AU treaty page |
| 8 June 2023 | Entry into force, after the fifteenth instrument (per the AU status list; Article 36 in the TanzLII and Veritas copies provides for entry into force 30 days after the fifteenth instrument) |
| 15 September 2025 | Madagascar deposits, the latest entry on the list |
| 2 February 2026 | AU status list: 21 signatories, 20 ratifications, 20 deposits |
Status checked on 8 November 2026 against the AU treaty page and status list. Ratifications continue, so recheck the list for each market.
Enforcement and penalties
The Convention has no fines of its own and no continental regulator. Enforcement happens at two levels:
- State level: national data protection authorities (Articles 11-12) can warn and sanction controllers, and national criminal law implementing Articles 29-31 sets offences and penalties, including fines for legal persons. The amounts are whatever each national law sets.
- Continental level: Article 32 asks the AU Commission Chairperson to report to the Assembly on a monitoring mechanism that tracks progress, advises states and reports to the Executive Council. Disputes between states go first to negotiation, then to peaceful means such as mediation (Article 34).
Both secondary copies of the text say a state may withdraw on one year's written notice (Article 38). For businesses the practical risk sits in the national law: a ratifying state may have a newer data protection or cyber security act that goes further than the Convention, and that national text is what an authority enforces. See the Ghana Cybersecurity Act 2020 and Mauritius Data Protection Act 2017 for two examples from ratifying states.
What it means for AI agents and non-human identities
The Convention predates AI agents, but its principles reach the automated systems that process personal data and touch critical infrastructure. Our view at NHI Mgmt Group:
- Automated decisions: Article 14 limits decisions with significant effects based solely on automated processing. AI agents that approve, deny or price services for individuals in ratifying states need a lawful basis, human involvement where national law requires it, and records of how each decision was reached. See the AI Agent Audit Trails for Regulators Guide.
- Confidentiality means authorised identities only: Article 20 limits processing to authorised persons acting on the controller's instructions. Service accounts, API clients and agents that read personal data are part of that boundary, so each needs a distinct identity, least-privilege scopes and an owner.
- Security precautions cover credentials: Article 21's duty to prevent unauthorised access applies to machine credentials as much as user passwords. Vault secrets, rotate them, and remove unused integrations. See the Service Account Security Guide.
- Transfers outside the AU: agents and SaaS integrations that send personal data to models or tools hosted outside Africa may be cross-border transfers under Article 14. Map where data flows, not just where it is stored.
- Unauthorised access offences: national laws implementing Article 29 can make misuse of another organisation's API keys or tokens a criminal offence, and Article 30 can reach the company on whose behalf an agent acted. Govern what your agents are allowed to access.
Compliance steps
- Map your footprint. List every African country where you process personal data, run infrastructure or serve customers, and record whether each has deposited the Convention.
- Find the national law. For each country identify the data protection act, cybercrime or cyber security act, authority and any registration or declaration duty; national law is what binds you.
- Register or declare where required. Many laws modelled on Article 10 require declaration to, or prior authorisation from, the authority, especially for sensitive and biometric data.
- Set one baseline. Build a common control set from Articles 13 and 20-23 (lawful basis, purpose, security, confidentiality, retention), then add country variations.
- Control cross-border flows. Document transfers outside the AU and the safeguards relied on, including for AI and SaaS tooling.
- Prepare incident handling. Identify national CERTs or CSIRTs and any notification duties under national law; build contacts before an incident.
- Govern automated processing. Inventory AI agents and automated decision systems affecting individuals and add human review where required.
- Review annually. Recheck the AU status list and national law changes at least once a year.
Small and large organisations
A business in one or two markets can work directly from the national law and authority guidance. A multinational with many African operations gains from a single regional baseline mapped to the Convention's Chapter II, with country annexes, because the Convention gives the common vocabulary many national laws share.
Measuring progress
- Countries of operation with a current national law assessment (target: all).
- Required declarations or authorisations filed and current.
- Cross-border transfer routes documented with safeguards.
- Non-human identities with access to personal data that have an owner and least-privilege scopes.
- Automated decision systems with documented human review where required.
Framework mapping
| Convention article | NIST CSF 2.0 | NIST SP 800-53 Rev 5 |
|---|---|---|
| 13, 22 principles and retention | GV.OC-03 | PM-2 |
| 20 confidentiality, authorised persons | PR.AA-01, PR.AA-05 | AC-2, AC-6, IA-9 |
| 21 security obligations | PR.AA-05, DE.CM-01 | SI-4, IA-5 |
| 24-27 national policy, incident institutions | RS.CO-02 | IR-6 |
| Risk assessment of processing | GV.RM-01, ID.RA-01 | RA-3 |
Common failure patterns
- Treating the treaty as the law: designing compliance to the Convention text instead of the national act that actually applies.
- Assuming all of Africa ratified: only 20 AU member states had deposited by February 2026.
- Missing declaration duties: processing biometric or health data without the prior authorisation many national laws require.
- Invisible transfers: AI services and SaaS tools moving personal data outside the AU without assessment.
- Shared integration accounts: generic service credentials reading personal data, which defeats the "authorised persons" principle.
Practitioner checklist
- Country list with Convention status from the current AU status list.
- National data protection and cyber laws, authorities and registration duties recorded per country.
- Declarations and prior authorisations filed where required.
- Regional baseline built from Articles 13 and 20-23 with country annexes.
- Cross-border transfers outside the AU documented with safeguards.
- Service accounts, API clients and AI agents with personal data access owned and scoped.
- National CERT or CSIRT contacts and notification duties in the incident plan.
- Annual review of ratifications and national law changes.
Standards and references
Source note: adoption, entry into force and ratification facts are from the African Union treaty page and status list. The official AU treaty PDF has no machine-readable text, so article-level content is taken from two secondary copies (TanzLII and Veritas Zimbabwe), which agree on the points used here. Confirm against the official text before relying on it.
- African Union: Convention on Cyber Security and Personal Data Protection (treaty page)
- African Union: Status list of signature, ratification and accession
- TanzLII (AfricanLII): African Union Convention on Cyber Security and Personal Data Protection, text (secondary source)
- African Union Convention on Cyber Security and Personal Data Protection: English text (secondary copy hosted by Veritas Zimbabwe; confirm against the official AU text)
- NIST: Cybersecurity Framework 2.0
- NIST: SP 800-53 Rev. 5, Security and Privacy Controls
Related NHI Mgmt Group resources: Budapest Convention and UN Cybercrime Convention Guide · Global Privacy Regulatory Map · Egypt Personal Data Protection Law Guide · Morocco Law 09-08. This guide summarises the African Union Convention on Cyber Security and Personal Data Protection as at 8 November 2026 and is not legal advice.