Malabo Convention
African Union Convention on Cyber Security and Personal Data Protection
Key Facts
Overview
The Malabo Convention is the African Union's continental framework treaty bundling data protection, cybercrime, cybersecurity, and e-commerce into one instrument. It entered into force on June 8, 2023, after taking 9 years to reach the required 15 ratifications. It sets minimum standards for national data protection laws but does not directly regulate websites.
What This Means for Your Website
- The Convention requires member states to enact national data protection laws
- Member states must establish independent DPAs
- The Convention itself does not directly regulate websites — national laws do
- 15 African countries have ratified; more national laws are expected as implementation progresses
- South Africa notably has NOT ratified
Key Requirements
No continental-level enforcement exists — enforcement is deferred to national implementing legislation. Each member state must establish an independent DPA. Criminal sanctions are required for cyber-related offences. Cross-border transfers are restricted to countries with adequate protection.
How ConsentStack Handles This
ConsentStack applies the consent requirements of national implementing legislation in each ratifying member state rather than the Convention directly.
Penalties
Deferred to national implementing legislation; convention requires criminal sanctions for cyber offences.
Key Requirements
- Member states must enact comprehensive data protection legislation
- Each state must establish an independent national DPA
- Personal data processing requires consent or lawful basis
- Cross-border transfers restricted to adequate-protection countries
- Criminal sanctions required for cyber offences
Notable Provisions
- Took 9 years to reach 15-ratification threshold
- Lacks enforcement mechanisms at continental level
- South Africa notably has NOT ratified
- Bundles four domains: DP, cybercrime, cybersecurity, e-commerce
Other Sub-Saharan Africa Regulations
Frequently Asked Questions
What is the Malabo Convention?
The AU's continental framework treaty on cybersecurity and data protection, entered into force June 2023 after 15 countries ratified it.
Does the Malabo Convention directly regulate websites?
No. It sets minimum standards that member states must implement through national legislation. National laws directly regulate websites.
Has South Africa ratified the Malabo Convention?
No. South Africa is a notable non-ratifier, relying instead on its own POPIA for data protection.
Stay compliant with Malabo Convention
ConsentStack helps you implement Opt-in consent for African Union member states automatically.