The Promise of Malabo
When the African Union adopted the Convention on Cyber Security and Personal Data Protection in June 2014 — commonly known as the Malabo Convention — it represented an ambitious attempt to create a continental governance framework addressing cybersecurity, electronic commerce, data protection, and cybercrime in a single instrument. The Convention was explicitly designed to provide African nations with a homegrown governance model that reflected continental priorities rather than importing wholesale from European (Budapest Convention) or American frameworks.
Twelve years later, the Convention has not entered into force. Its requirement of 15 ratifications has not been met — a structural failure that reflects deeper tensions between continental aspiration and national interest, between digital sovereignty and foreign infrastructure dependence, and between the speed of digital transformation and the pace of governance development.
14/55
Ratifications
AU members ratifying the Convention
$4.2B
Annual losses
Estimated African cybercrime damages
12
Operational CERTs
Across 55 AU member states
Why Ratification Has Stalled
The barriers to ratification are multiple and mutually reinforcing:
Capacity Constraints
Many AU member states lack the institutional infrastructure to implement the Convention's requirements. Establishing the mandated national cybersecurity authorities, data protection commissions, and CERT capabilities requires human capital, technical expertise, and sustained funding that competes with more immediately visible development priorities. The Convention imposes obligations without providing implementation support — a design flaw that GDPR avoided through multi-year transition periods and EU-funded capacity building.
Sovereignty Concerns
Several member states view the Convention's cross-border cooperation provisions and mutual legal assistance requirements as potential constraints on national sovereignty. Countries with authoritarian governance structures are reluctant to adopt frameworks that could be invoked to challenge domestic surveillance practices or content control measures.