Malabo Convention

The Malabo Convention

African Union Convention on Cyber Security and Personal Data Protection
Type	Regional
Drafted	2011
Signed	2014 (2014)
Location	Malabo
Sealed	May, 2023
Ratified	May, 2023
Effective	June 2023
Parties	Algeria Angola Benin Botswana Burkina Faso Burundi Cameroon Central African Republic Cape Verde Chad Côte d’Ivoire Comoros Congo Djibouti Democratic Republic of the Congo Egypt Equatorial Guinea Eritrea Ethiopia Gabon Gambia Ghana Guinea-Bissau Guinea Kenya Libya Lesotho Liberia Madagascar Mali Malawi Morocco Mozambique Mauritania Mauritius Namibia Nigeria Niger Rwanda South Africa Sahrawi Arab Democratic Republic Senegal Seychelles Sierra Leone Somalia South Sudan Sao Tome and Principe Sudan Eswatini Tanzania Togo Tunisia Uganda Zambia Zimbabwe
Ratifiers	Angola Cape Verde Congo Ghana Guinea Mauritania Mozambique Namibia Niger Rwanda Senegal Sao Tome and Principe Togo Zambia Côte d’Ivoire Mauritius
Languages	English Arabic French Portuguese
Total countries: 55 – Signatures: 21, Ratifications: 16, Deposits: 16

The African Union Convention on Cyber Security and Personal Data Protection also known as the Malabo Convention is a 2014 legal framework adopted by the African Union (AU) to address cybercrime and data protection in Africa.

Contents

The Malabo Convention is divided into three main chapters:

Electronic transactions chapter

The Convention outlines unified guidelines and regulations for different aspects of e-commerce, such as online advertising, the legal recognition of electronic contracts, and securing electronic payment systems.

Data protection chapter

The Malabo Convention requires all member states to develop a comprehensive data protection framework. As outlined in Article 8(1), it

aimed at strengthening fundamental rights and public freedoms, particularly the protection of physical data, and to punish any violation of privacy without prejudice to the principle of the free flow of information.

— The African Union, African Union Convention on Cyber Security and Personal Data Protection, Article 8(1)

Also, Articles 11, 13, and 16 to 19 further specify that this framework must be overseen by a national data protection authority (DPA), which should operate independently and be responsible for ensuring that personal data processing is properly regulated. The national framework must reflect essential data protection standards—such as obtaining consent, ensuring legality, maintaining confidentiality, and promoting transparency—while also guaranteeing individuals specific rights over their personal information.

Cybersecurity and cybercrime chapter

The Malabo Convention criminalise different cyber activities and obliges each member state to create a national cybersecurity policy and strategy. It also calls for the formation of relevant institutions and mechanisms to detect and address cybersecurity threats, uphold key cybersecurity values, and foster international collaboration. Regarding cybercrime, the Convention urges states to enact national laws and regulations that criminalize “acts which affect the confidentiality, integrity, availability and survival of information and communication technology systems, the data they process, and the underlying network infrastructure.

History

The African Union introduced the convention in 2011 aimed at creating a trustworthy cybersecurity structure across the continent. Its objectives included regulating electronic transactions, safeguarding personal information, enhancing cybersecurity, encouraging e-governance, and addressing cybercrime. The adoption of the convention was postponed several times until 2014 when it was adopted at its 23 Ordinary Session at Malabo in Equatorial Guinea. However, it did not come into implementation because of the Article 36 that showed that the treaty will come to force upon the ratification of at least 15-member nation of the African Union. 

Implementation

On 8 of June 2023, the Malabo Convention came to effect 30 days after the ratification of Mauritania as the 15 member nation to fulfilled the Article 36 of the Malabo Convention.

In Sudan

Sudan signed the Malabo Convention on 15 March 2023, during the African Union Summit in Addis Ababa. The convention was signed by the then-acting Minister of Telecommunications and Digital Transformation, Adel Hassan Mohamed Al-Hussein, in the presence of officials from the AU Commission and Sudan’s regulatory authority. However, the country is yet to ratify the convention

List of signatories and ratified countries

Below are the list of countries who have signed and ratified the African Union (AU) Convention on Cyber Security and Personal Data Protection

African Union Convention on Cyber Security and Personal Data Protection – Status by Country (as of 8 July 2024)

No.	Country	Date of Signature	Date of Ratification/Accession	Date Deposited
1	Algeria	–	–	–
2	Angola	–	21/02/2020	11/05/2020
3	Benin	28/01/2015	–	–
4	Botswana	–	–	–
5	Burkina Faso	–	–	–
6	Burundi	–	–	–
7	Cameroon	12/08/2021	–	–
8	Central African Republic	–	–	–
9	Cape Verde	–	13/11/2020	05/02/2022
10	Chad	14/06/2015	–	–
11	Côte d’Ivoire	–	08/03/2023	03/04/2023
12	Comoros	29/01/2018	–	–
13	Republic of the Congo	12/06/2015	24/09/2020	23/10/2020
14	Djibouti	12/05/2023	–	–
15	Democratic Republic of the Congo	–	–	–
16	Egypt	–	–	–
17	Equatorial Guinea	–	–	–
18	Eritrea	–	–	–
19	Ethiopia	–	–	–
20	Gabon	–	–	–
21	Gambia	02/12/2022	–	–
22	Ghana	04/07/2017	13/05/2019	03/06/2019
23	Guinea-Bissau	31/01/2015	–	–
24	Guinea	–	31/07/2018	16/10/2018
25	Kenya	–	–	–
26	Libya	–	–	–
27	Lesotho	30/11/2023	–	–
28	Liberia	–	–	–
29	Madagascar	–	–	–
30	Mali	–	–	–
31	Malawi	–	–	–
32	Morocco	–	–	–
33	Mozambique	29/06/2018	02/12/2019	21/01/2020
34	Mauritania	26/02/2015	19/04/2023	09/05/2023
35	Mauritius	–	06/03/2018	14/03/2018
36	Namibia	–	25/01/2019	01/02/2019
37	Nigeria	23/01/2024	–	–
38	Niger	–	22/02/2022	16/03/2022
39	Rwanda	16/04/2019	14/11/2019	21/11/2019
40	South Africa	16/02/2023	–	–
41	Sahrawi Arab Democratic Republic	–	–	–
42	Senegal	–	03/08/2016	16/08/2016
43	Seychelles	–	–	–
44	Sierra Leone	29/01/2016	–	–
45	Somalia	–	–	–
46	South Sudan	–	–	–
47	Sao Tome and Principe	29/01/2016	25/09/2023	15/02/2024
48	Sudan	15/03/2023	–	–
49	Eswatini	–	–	–
50	Tanzania	–	–	–
51	Togo	02/04/2019	30/09/2021	19/10/2021
52	Tunisia	23/04/2019	–	–
53	Uganda	–	–	–
54	Zambia	29/01/2016	15/12/2020	24/03/2021
55	Zimbabwe	–	–	–