Data Protection Readiness Check

Has your organisation named a person responsible for personal data protection (a data protection officer or equivalent)?

Has management been briefed on the law's obligations and approved a compliance plan now that the transition period has ended?

Do you keep a register of your processing activities (at least what the law lists: your contact details and those of any processor, purposes, categories of people and data, categories of recipients, and the authorisation number)?

Have you started obtaining the prior authorisation the law requires for your processing activities?

For each processing activity, have you recorded its legal basis: the person's consent, or one of the exceptions the law allows (a legal obligation, a public-interest mission or protecting health)?

Where you rely on consent, is it given before processing starts, freely, specifically and expressly (for example an unticked box), and can you prove it?

For people under 18, is their consent backed by that of their parents or legal representative?

When you collect personal data, do you tell people, at the latest when you collect it, who you are, why you collect it, which categories of data, who receives it, how long you keep it, their rights (including the right to refuse to be in the file) and any transfer abroad?

Is that information available in the languages your customers and staff use (French and English)?

Do you have a procedure to handle requests to access, correct, delete, restrict, receive a copy of (portability) or object to the use of personal data, within a set deadline?

Can you find and export all the data you hold about one person across your systems?

Are personal data protected by access control, so that staff only see what their job requires?

Are personal data encrypted in transit, and at rest on laptops, phones and backups?

Are personal data backed up, with restores tested, so you can recover from loss or ransomware?

Do you have a written contract with each provider that processes data for you (IT, cloud, payroll, call centres), setting the types of data, the categories of people and each party's obligations and rights?

Do you know which personal data are stored or processed outside Cameroon, including in foreign cloud services, email and messaging tools?

For each transfer abroad, have you obtained the prior authorisation the law requires, or started the application?

Do you have a procedure to detect, record and respond to personal data breaches?

Does that procedure say when and how to notify the authority and the people affected?

Have you set a retention period for each category of data, and do you delete or anonymise data when it ends?

If you process sensitive data (health, biometrics, religious, philosophical or political opinions, ethnic, linguistic or regional origin, criminal records, banking transactions), have you confirmed with counsel that the law allows it and applied strict safeguards?