Suspect a breach? Report it immediately — response within 1 hour.Report an incident
EBH Security
Contact us

Malabo Convention

African Union Convention on Cyber Security and Personal Data Protection (2014) — the continental reference framework for electronic transaction security, the fight against cybercrime, and data protection across Sub-Saharan African countries.

Last updated — August 22, 2026

Who's affected

African Union member states that have signed or ratified the convention, and by extension organizations operating in those countries, for whom this continental baseline provides a shared reference on cybersecurity and data protection, complementing the national legislation in force.

What the framework requires

The Malabo Convention sets out shared principles covering electronic transaction security, the fight against cybercrime, and personal data protection, which each member state transposes into its national law. It thereby establishes a shared continental orienting baseline, whose implementation draws on the legislation and national authorities of each signatory country.

Deadlines

The convention leaves each member state responsible for setting, in its national transposition law, the compliance timelines applicable within its territory; these deadlines should therefore be verified at the level of the country concerned.

Sanctions

The applicable sanctions regime falls under the national cybersecurity and data protection laws adopted by each state in transposing the convention; the national framework of the country concerned should be consulted for its precise scope.

Compliance steps

01

Identifying the applicable national framework and its degree of transposition of the Malabo Convention

02

Reviewing existing national cybersecurity and data protection legislation, where applicable

03

Aligning with the convention's principles where no detailed national text exists (transaction security, data protection)

04

Implementing recognized good practices (notably ISO 27001) as a transposable baseline independent of local regulatory maturity

05

Country-by-country regulatory watch, as application of the convention is expected to evolve alongside national legislation

Common mistakes

  • Assuming the Malabo Convention produces a uniform, directly applicable legal effect across all signatory countries
  • Overlooking that the level of effective enforcement varies significantly by each state's regulatory maturity
  • Waiting for the national framework to fully mature before implementing security controls, when international standards can already serve as a baseline

Downloadable resource

Get the checklist by email.

Frequently asked questions

Is the Malabo Convention directly applicable to businesses?

No, it is a treaty between states that must be transposed into each signatory country's national law to produce effects directly enforceable against organizations; the level of transposition varies significantly by country.

Are all African countries covered by this convention?

No, only African Union member states that have signed it and, for full entry into force, ratified it are formally bound; signature and ratification status varies by country.

How does EBH Security draw on the Malabo Convention in countries where national legislation continues to take shape?

EBH Security draws on the Malabo Convention's principles as a shared orienting baseline, combined with recognized international standards (notably ISO 27001), to maintain a consistent security level regardless of how far local regulation has progressed.

Does the convention cover both cybersecurity and personal data protection?

Yes, it addresses both areas in a single text, which makes it a reference point for countries that do not yet have two separate laws on these topics.