AU Malabo Convention
Market regime · African Union Convention on Cyber Security and Personal Data Protection (2014)
African Union
Africa (AU)
Adopted 2014; in force June 2023
State parties; national authorities implement
The continental baseline for data protection and cybersecurity
Curated, versioned & cross-mapped
The obligation, plainly.
The Malabo Convention is the African Union's continental instrument, and unusually it carries two regimes in one text: a data-protection chapter of principles, rights and authorities, and a cybersecurity chapter obliging national frameworks, protection of critical information infrastructure, CERT cooperation and cybercrime measures.
Having entered into force in June 2023 after its fifteenth ratification, it is the reference point for where African digital regulation is converging, and the catalog curates it as the continental baseline beneath the national regimes.
Where programmes are tested.
The data-protection chapter
Principles, rights and independent authorities: the continental floor national laws implement.
The cybersecurity chapter
National frameworks, critical-infrastructure protection and CERT cooperation.
Cybercrime measures
Offences and procedural powers member states legislate against.
Curated once, evidenced continuously.
- Curated as the continental layer: its privacy chapter maps to the shared privacy controls, its cyber chapter to the governance and technical set, one baseline beneath every market in the portfolio.
- Requirements resolve to shared controls: implement a control once and it counts toward every framework it maps to.
- Status is evidence-gated: a requirement can't be marked implemented without valid, in-date evidence behind it.
- Every attestation carries maker/checker, and every action lands in an append-only audit trail.
AU Malabo Convention, asked plainly.
The questions compliance teams actually ask before an adoption decision or an audit.
Is the Malabo Convention actually in force?
Yes, it entered into force in June 2023 after Mauritania's fifteenth ratification, nine years after adoption. Ratification is still spreading, but the convention now formally anchors the continent's data-protection and cybersecurity direction.
Does it bind companies directly?
No, it binds state parties, who legislate nationally. Its value to an institution is as the convergence map: national laws increasingly align to it, so a programme built to its baseline travels well across African markets.
Why does one convention cover both privacy and cyber?
Malabo deliberately packaged electronic transactions, data protection and cybersecurity as one digital-trust agenda. Practically that means its requirements map to two control families at once, privacy controls for one chapter, governance and technical controls for the other, which the catalog models explicitly.
Where it connects.
The full catalogCompliance you can prove.
Walk into your next audit ready.
Book a working demo. We'll map your obligations to the standards you're audited against and the regulators you actually answer to.
The platform, modules, catalog, audit trail and security architecture are live today; the continuous live-evidence engine is in active development, shown in a working demo. Reach us at hello@cardinalgrc.com.