The Malabo Convention: Africa’s Digital Rulebook

The African Union Convention on Cybersecurity and Personal Data Protection, also known as the Malabo Convention, is designed to help African countries build stronger and harmonised regulations for the digital age. It covers key issues like electronic commerce, data protection, cybercrime and cybersecurity. Once a country ratifies the Convention, it commits to bringing its national laws in line with these shared standards.

The Convention was adopted in Malabo in 2014 to respond to the challenges and opportunities of the continent’s digitalisation. It provides a common legal framework and clear standards for a harmonised digital transition, protecting digital rights and sanctioning cyber crimes. 

At the international level, the Budapest Convention is the legal instrument on cybercrime and serves as a useful guideline for countries developing cybercrime legislation. Benin and Senegal among other African countries are part of it.

The State of Ratification

As of 2026, only 20 African countries out of 55 have formally ratified the Malabo Convention. However many African states have already introduced their own laws on cybercrime and data protection.

The Case for Ratification

As Africa becomes more digitally connected than ever before, adopting and implementing a common framework to protect digital rights and personal data is strategic for the continent. This is why the Youth Democracy Cohort pushes for ratification of the Malabo convention in its policy recommendations to strengthen digital rights in the Sahel and West Africa.

Gaps and Challenges

However, twelve years after its adoption, the Convention struggles to keep pace with developments it could not have foreseen, and to ensure strong citizen’s protection and participation. Rather than simply celebrating it, we want to look honestly at what it makes possible and where it still falls short.

Critics note that the Convention does not define key concepts such as “personal data breach” or “pseudonymisation” nor does it include a monitoring mechanism of the implementation of the Convention or require algorithm transparency, both important for user protection.

While it urges States to respect basic rights such as freedom of expression and the right to privacy, the language of the Convention leaves space for the repression of these rights and lacks sufficient safeguards. It also requires some adaptations to new challenges such as the development of Artificial Intelligence.