The Nigeria Data Protection (Establishment, etc.) Act 2023 is the general data protection legislation applicable in Nigeria. Prior to the enactment of the NDPA, data protection in Nigeria was regulated pursuant to the Nigerian Data Protection Regulation 2019 (the “NDPR”) and the Nigerian Data Protection Regulation Implementation Framework. The NDPA is a “general” legislation, which sets the minimum requirements for protection of personal data in Nigeria. Accordingly, sectoral regulators in Nigeria, may prescribe additional data privacy requirements and standards for businesses in Nigeria.
The NDPA adopts an establishment and targeting criteria for the determining the. Accordingly, the NDPA applies where (a) a data controller and/or data processor is domiciled, operating in or resident in Nigeria (b) regardless of the place of establishment, a data processor or controller processes the data of a Nigerian citizen or processes any personal data within Nigeria. On this basis, foreigners who sell goods or services to Nigerians will generally be required to comply with the NDPA.
The NDPA applies to the processing of personal data, whether done by automated means or by non-automated means. The NDPA does not apply to processing of personal data carried out by one or more persons solely for personal or household purposes.
Yes, national derogations are permitted under the NDPA. The obligations under Part V of the NDPA (excluding sections 24, 25, 32 and 40 of the NDPA) do not apply to data controllers or data processors if the processing of personal data is carried out (by a competent authority) for the purposes of or in respect of
The possible category of plaintiffs includes:
(a) a Data Subject who can prove that they have suffered some injury, loss or harm as a result of a breach of the NDPA; and
b) the Nigerian Data Protection Commission (the “Commission”), where someone has laid a complaint to the Commission or of its own accord, upon reasonable belief that a breach of the NDPA has occurred. Persons who submit a complaint to the Commission must be able to demonstrate that (i) a complainant has a legal interest in the subject of the complaint (ii) the complaint is not frivolous or vexatious.
No. However companies trading in personal data are required to comply with the requirements of the NDPA
A Data Controller is defined as any individual, private entity, public commission or agency who or which, alone or jointly with others, determines the purposes and means of the processing of personal data.
A Data Processor is any individual, private entity or public authority, who or which processes personal data on behalf of or at the request of a data controller or another data processor.
A Data Subject is any individual to whom personal data relates.
Personal Data is any information relating to an individual who is identified or identifiable directly or indirectly by reference to identifiers such as:
Processing is broadly defined in the NDPA as the performance of any operation or set of operations on personal data, whether or not by automated means, including:
It should be noted that processing does not include the mere transit of data originating outside Nigeria.
The NDPA highlights six key principles which form the core of the data protection regime in Nigeria and govern personal data processing. The principles are:
A valid consent is one that is freely given, specific, informed and unambiguous. The silence or inactivity of the data subject does not constitute consent.
The forms of consent include Explicit Consent and Opt-in Consent.
Generally, specific consent is required with regard to
Yes, it can. Data Subjects have the right to withdraw their consent to the processing of their personal data at any time.
Processing of personal data conducted prior to the withdrawal of consent remains lawful and unaffected by the subsequent withdrawal.
Data Controllers/processors who engage data processors have the following obligations:
Yes, the DPA defines data pseudonymization as the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.2
No, the NDPA does not expressly define anonymization. However, anonymization is generally considered to be a data processing technique that modifies personal information of data subjects in such a way that it no longer relates to an identified or identifiable individual.
No, the DPA does not expressly define ‘joint controller’. However, data controllers are defined to be those who, alone or jointly with others, determine the purposes and means of the processing of personal data. The concept of a joint controller is also implied within the definition of “Data Controller” under the NDPA.
There is no general requirement for all companies to appoint a DPO under the NDPA. Only companies/data controllers of major importance are required to appoint DPOs. Data Controller/Processor of major importance means a data controller or data processor that is domiciled, resident in, or operating in Nigeria and processes or intends to process personal data of more than such number of data subjects who are within Nigeria, as the Commission may prescribe, or such other class of data controller or data processor that is processing personal data of particular value or significance to the economy, society or security of Nigeria as the Commission may designate.
Section 24 of the NDPA places an obligation on Data Controllers, or Data Processors who engage another data processor to take reasonable measures to ensure that the latter complies with all applicable principles and obligations set out in the section. ‘Measures’ for the purpose of this, shall include a written agreement between the data controllers and the data processor, or between data processors, as the case may be. This Data Processing Agreement is also typically referred to as the Data Processing Addendum
The age of consent under the NDPA is 13 years.
The penalty for non-compliance is a Compliance Order made by the Commission against the defaulter. The Compliance Order may include either a warning, compliance order, or a cease or desist order or a fine.
Data Subjects have the following rights with respect to their personal data:
A Data Protection Impact Assessment (DPIA) is defined as a process designed to identify the risks and impact of an intended processing of personal data. A DPIA comprises a systematic description of the envisaged processing and its purpose; an assessment of the necessity and proportionality of processing as against the purpose of processing; an assessment of the risks to the rights and freedoms of a data subject, and others.
The NDPR highlights situations in which a DPIA is required. A DPIA is required for the following types of processing:
A personal data breach is defined as a breach of security of a data processor leading to or likely to lead to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data of data subjects in custody of the processor.
The rules on reporting data breaches are as follows:
All notifications mentioned above must contain the name and contact details of the data controller; describe the likely consequences of the personal data breach; describe the measures taken to address the breach and measures to mitigate its possible consequences.
Generally, a Data Controller or Processor is not permitted to transfer or grant permission for the transfer of personal data from Nigeria to another country. The exceptions are, however, where:
In the absence of adequacy of protection, a data controller/processor can only transfer personal data from Nigeria to another country if the following occurs:
Sensitive personal data is defined as personal data relating to an individual’s –
Data Protection Officers are appointees of data controllers, of major importance for the sole purpose of compliance with the Act, possessing expert knowledge of data protection law and practices, and the ability to fulfil requirements under the Act and any subsidiary legislation. A DPO may be an employee of such a data controller or be engaged through a service contract.
DPOs have the following duties:
A DPCO is a body or person possessing the requisite level of expertise in data protection, and licensed by the Commission under the NDPA. Their role is to monitor, audit and report on the compliance by data controllers/processors with applicable data protection regulations.
The right of data portability entitles a Data Subject to receive his personal data in a structured, commonly used and machine-readable format, and to transmit the same to another data controller without any hindrance, if possible, directly.
Yes, Data Subjects have the right to object to processing of their personal data. This applies where the processing is for the performance of a task to be carried out in the public interest and the purpose of the data controller’s or processor’s legitimate interest, or for profiling. It also applies where personal data is processed for direct marketing purposes.
No, it is not. A data controller may not discontinue the data processing if it can demonstrate that the public interest or other legitimate grounds override the fundamental rights, freedoms and interest of the data subject.
Yes, it is. Data Subjects have the right not to be subjected to a decision based solely on automated processing of personal data that produces legal or similarly significant effects for them.
Automated decision making is defined as a decision made by automated means without any human involvement. Examples of automated decision making include an online decision to award a loan or a recruitment aptitude test which uses pre-programmed algorithms and criteria.3
No, it is not. This right is not recognized in the following instances:
Binding Corporate Rules are defined as personal data protection policies and procedures adhered to by the members of a group of firms under common control with respect to the transfer of personal data among such members and containing provisions for the protection of such personal data.
No, it has not been repealed. All extant regulations made by NITDA before the enactment of the NDPA remain in force upon the enactment of the NDPA 2023 until specifically repealed.