Data Protection in Cameroonian Digital Health: What to Know

Digital health promises faster, safer care. It also concentrates some of the most sensitive information a person has in systems that can be breached, misused or simply mishandled. Cameroon now has a dedicated personal data protection law, adding to its earlier laws on cybersecurity and electronic communications.

This article sets out, for patients and for health facilities, what the legal framework looks like, what good practice means in day-to-day work, and how OpesCare is built to support it.

Important: this is general information, not legal advice. Laws and their implementing texts change. Always check the official text published in Cameroon and consult a qualified lawyer before making compliance decisions.

The legal framework at a glance

Law No. 2024/017 on personal data protection

Adopted on 23 December 2024, Law No. 2024/017 is described by DLA Piper and other legal commentators as Cameroon's first standalone personal data protection law. According to published commentaries, it:

• sets rules for collecting and processing personal data;
• gives individuals rights over data about them;
• restricts transfers of personal data outside Cameroon unless the destination country ensures an adequate level of protection (commentators cite Article 32);
• provides for an independent personal data protection authority (commentators cite Article 53);
• gave organisations an 18-month transition period to comply, reported as ending in June 2026 (commentators cite Article 73).

Commentators also reported that setting up the authority depended on implementing texts that had not yet been published at the time of their review. Published summaries disagree on penalty amounts, so we do not quote them here.

Law No. 2010/012 on cybersecurity and cybercriminality

Adopted on 21 December 2010, this law sets the security framework for electronic communication networks and information systems and defines ICT-related offences — including illegal access to systems, interception and interference with data. It also contains provisions aimed at protecting privacy. For health systems, it means unauthorised access to records can be a criminal matter, not only a disciplinary one.

Law No. 2010/013 on electronic communications

Adopted the same day and amended by Law No. 2015/006 of 20 April 2015, it governs electronic communications networks and services and established the regulator (ART). SMS verification codes, mobile money and app traffic all depend on these regulated networks.

The policy side

The 2020–2024 National Digital Health Strategic Plan published by MINSANTE includes legislation and compliance among its strategic areas, alongside standards and interoperability. Data protection is part of the national digital health agenda, not an afterthought.

Why health data needs special care

Health data can reveal a diagnosis, a pregnancy, an HIV status, a mental health condition. Its misuse can lead to stigma, discrimination at work or in the family, or fraud. Many data protection frameworks around the world treat health data as a sensitive category; facilities should assume the highest standard of care applies.

What patients should know

Your rights in practice

Ask any facility or app that holds your health data:

• What do you collect, and why?
• Who can see it?
• Can I see it myself, and correct it?
• Where is it stored?
• How do I withdraw consent or complain?

A trustworthy service answers these in plain language.

On OpesCare specifically

• You can see your own record at any time.
• A clinician needs a care relationship or your consent to open it.
• You can approve, deny or revoke consent requests.
• Every access appears in your access log.
• Nobody can search for you by name.
• Emergency access opens only a limited profile, needs a reason, alerts you and is reviewed.

Read the patient guide to consent and our privacy notice.

Everyday precautions

• Do not share login codes sent by SMS with anyone, including people claiming to be staff.
• Keep your QR card private.
• Be wary of messages asking you to "confirm" health details through unfamiliar links.

What health facilities should do

Whatever software you use, a few practices go a long way.

1. Minimum necessary access

Staff should see only what their role requires. A receptionist does not need laboratory results; a pharmacist needs the prescription, not the full history.

2. Role-based permissions and personal accounts

Every staff member should have their own account with a defined role. Shared logins make it impossible to know who did what. Deactivate accounts promptly when people leave.

3. Audit trails

Record who accessed which record, when and why — and review it. An audit log nobody reads protects nobody.

4. Transparency with patients

Tell patients what you record and who sees it. Systems that let patients see their own access log build trust and deter misuse.

5. No silent deletion

Clinical records should be corrected or voided with a trail, not deleted. This protects both the patient and the clinician.

6. Know where data goes

Before using any service that stores or transfers patient data, ask where it is hosted and whether transfers abroad are involved, in light of the law's restrictions on cross-border transfers.

7. Prepare for incidents

Know who to call, what to contain and how to inform those affected if something goes wrong.

A short checklist for facility managers

Use these questions to review where you stand. They are not a legal compliance test, but a practical starting point.

1. Do we know what personal data we collect, on paper and electronically, and why?
2. Does every staff member have a personal account, and do roles limit what each person sees?
3. Can we tell who opened a patient's record last week?
4. Do we tell patients, in plain language, how their data is used and who sees it?
5. Do we know where our systems are hosted and whether any data leaves Cameroon?
6. Do our suppliers and software vendors have written commitments on data security?
7. Do we have a procedure for incidents — a lost laptop, a stolen phone, a suspected breach?
8. Do we destroy paper records safely when they are no longer needed, in line with retention rules?
9. Have we read the official text of Law No. 2024/017 and sought legal advice where we are unsure?

Common misconceptions

"Data protection means we cannot share anything." No. Sharing for care, under a clear basis and with appropriate safeguards, is how health systems work. The point is to share the right data, with the right people, for the right reason — and be able to show it.

"Our software vendor handles compliance." Software can make good practice easier, but the facility remains responsible for how it uses patient data.

"Paper records are not covered." Data protection concerns personal data, whatever the medium. A register left open on a desk is a privacy risk too.

"Only large hospitals need to worry." Small clinics and pharmacies hold sensitive data as well, and patients expect the same care.

How OpesCare is built to support this

OpesCare is a private, patient-centred Health ID network. Its design choices are meant to make good practice the default:

• Consent before access — every clinician read is checked against a care relationship or a patient-approved grant.
• Patient-visible access log — every access is recorded and shown to the patient.
• No name search — staff look up patients only by exact Health ID or QR.
• Facility isolation — a facility's identity comes from the signed-in session, and access across facilities is refused.
• Role-based capabilities — each role sees only the screens and actions it needs.
• Immutable clinical entries — amended or voided with a trail, never deleted.
• Multi-factor authentication for platform administrators.
• Documents generated on demand — patient PDFs are rendered when downloaded rather than stored, and carry a verification QR.
• Aggregates only for national reporting — when facilities prepare DHIS2 reports, only counts are sent, after an administrator's review.
• Hardened web security — a strict content security policy and webhooks that refuse internal network addresses.

None of this replaces a facility's own legal obligations. It gives facilities tools that make those obligations easier to meet.

Conclusion

Cameroon's data protection framework is now in place in law, with Law No. 2024/017 joining the 2010 laws on cybersecurity and electronic communications, and some implementing details still being reported as pending. Patients can ask clear questions about their data; facilities can adopt simple, effective practices. OpesCare is designed so that consent, transparency and minimum necessary access are how the system works by default.

Read our privacy notice, get your free Health ID, or, for facilities, apply to join the network. Questions about how we handle data? Contact us.

Related reading: health data, law and innovation in Cameroon.