Website Security for Cameroonian Businesses: A Practical Checklist After This Week's Fintech Warning
Cameroon's cybersecurity agency warned this week about rising fintech threats, and a new data protection law now applies to your website. Here is a plain checklist to protect your customers' data and your business.
Category: Engineering
If your business takes orders, bookings, sign-ups or payments online, you hold customer data. That means phone numbers, names, addresses and sometimes payment details. This week, the government said that data is under growing threat. A data protection law now also covers it. Most small businesses in Cameroon have not checked either.
This post covers what changed and what to do about it. The steps are practical, and most cost little or nothing.
What happened this week
At the Digitise Cameroon 2026 forum, around 100 companies gathered in Mbankomo for a three-day forum on regulation, cybersecurity and strategic partnerships. The head of ANTIC, the national ICT agency, warned that fast fintech growth is exposing the country to more sophisticated cyber threats.
The scale explains the concern. In 2024, digital payment services generated more than FCFA 1,022 billion in revenue, about 3.16% of GDP, and active mobile subscriptions passed 31.5 million. A lot of money and personal data now moves through phones and websites.
The forum was aimed at fintech companies. But if you run a shop, school portal, NGO donation page or booking site, you sit in the same chain. Attackers often go after the weakest site, not the biggest one.
The law you may have missed: Law No. 2024/017
Cameroon passed its first dedicated data protection law on 23 December 2024. Article 73 gave organisations 18 months, until 23 June 2026, to comply. That date has passed.
The law is broad. It applies to public and private organisations, and to professionals acting in their own name, that process the personal data of people residing or in transit in Cameroon. A small online business falls inside that.
The main points for a website owner, based on legal summaries:
- Consent matters. The law requires consent for processing personal data unless the law provides otherwise.
- Breaches must be reported. Once a controller or processor knows of a personal data breach, they must immediately inform the Personal Data Protection Authority and the person affected.
- Moving data abroad needs approval. Transfers of personal data outside Cameroon are subject to prior authorisation from the APDP. This matters if your site stores customer records on a foreign server.
One caveat. Reports say the regulator is not yet fully operational, and details such as technical standards are still expected. Do not read that as permission to wait. Customers can still be harmed by a breach, and the rules will become clearer over time. Check with a lawyer for your exact obligations. This post is not legal advice.
A 10-point security checklist
Work through these in order. Most take under an hour each.
1. Use HTTPS everywhere
Your site address should start with https:// and show a padlock. Most hosts offer free certificates. If your site still loads over plain http, passwords and form data travel unprotected.
2. Keep software updated
Old WordPress plugins and outdated frameworks are the most common way small sites get hacked. Update your CMS, themes and plugins monthly. Delete the ones you do not use. If your site runs on Laravel, update to supported versions. Laravel 13 requires PHP 8.3 or higher, so ask your developer or host which PHP version you run.
3. Fix your passwords and logins
- Use a unique, long password for hosting, email, your domain registrar and your admin panel.
- Turn on two-factor authentication wherever it exists.
- Remove accounts for former staff or freelancers the day they leave.
Modern frameworks are also moving past passwords. Laravel 13 added first-party passkey support, a phishing-resistant alternative to passwords. If you are commissioning a new system, ask whether it can use them.
4. Never store what you do not need
This is the cheapest protection there is. If you do not need a customer's date of birth or ID number, do not ask for it. The law says data should be collected for a specific, legitimate purpose and not kept indefinitely. Data you never collected cannot be stolen.
5. Let payment providers handle payment details
Do not build your own form that stores mobile money PINs or card numbers. Use the hosted checkout of your payment provider so sensitive details never touch your server. For setup, see our guide on accepting mobile money payments on your website.
6. Back up your site and database
Keep automatic daily backups. Store at least one copy somewhere other than your hosting account. Then test a restore once. A backup you have never tested is a guess.
7. Add a clear privacy notice and consent
Write a short privacy page in plain English and French. Say what you collect, why, how long you keep it and who to contact. Add a consent checkbox to forms, unticked by default. Cookies such as _ga and _fbp collect personal data, so if you use Google Analytics or a Facebook pixel, tell visitors.
8. Limit who can see what
Not every staff member needs admin access. Give people the lowest level that lets them do their job. A shop assistant who updates product photos does not need access to the customer list.
9. Watch for phishing and fake messages
Most attacks start with a message, not a technical exploit. Train your team on three rules:
- Nobody from MTN, Orange or your bank will ask for your PIN or OTP code.
- Check the sender address before you click links in emails about "hosting renewal" or "account suspended".
- Confirm unusual payment requests by calling the person on a number you already have.
10. Write a one-page breach plan
Decide in advance who does what if something goes wrong. A basic plan names who takes the site offline, who contacts the host, who informs customers, and who handles the legal duty to report. Keep the phone numbers on paper as well as on a screen.
What this costs
Steps 1 to 4 and 6 to 10 cost mostly time. Free SSL certificates, two-factor authentication and a privacy page do not need a budget. Your main possible costs are a managed backup service and a developer's hours for an audit. Prices vary by provider, so get two or three quotes and ask what each includes.
Who this matters most for
E-commerce shops hold addresses, phone numbers and order histories. Schools hold student records, including data about minors. Nonprofits hold donor details and sometimes sensitive information about beneficiaries. In each case, a leak damages trust in a way that is hard to repair, whether you are in Douala, Yaoundé, Bafoussam, Garoua or Bamenda.
A simple way to start this week
- List every place your business stores customer data: website, spreadsheets, WhatsApp groups, email, paper forms.
- Check who has access to each one.
- Fix the three easiest gaps from the checklist above.
- Add the privacy notice to your site.
- Book a proper review with a developer if you handle payments or sensitive records.
If you would like someone to review your site, Aneta Prime, a web development company in Bamenda, does security reviews and builds sites with these protections from the start. Whoever you choose, ask for a written list of what was checked and what was fixed.
Security is not a one-time task. Set a calendar reminder for the first of each month: update, check backups, review who has access. Ten minutes a month prevents most of the problems that make the news.
Tags: website security, data protection, Cameroon, e-commerce, cybersecurity, small business