Data Strategy — Nigeria regulation

On 12 June 2023 President Bola Tinubu signed the Nigeria Data Protection Act into law, establishing the country first full data protection legislation and creating the Nigeria Data Protection Commission NDPC as an independent regulatory authority. The Act supersedes the Nigeria Data Protection Regulation NDPR of 2019 and provides improved enforcement powers and clearer compliance obligations for organizations processing personal data of Nigerian residents.

Key Provisions of the Data Protection Act

The Act sets up a modern data protection framework largely aligned with international standards including GDPR principles. Organizations currently compliant with NDPR will find significant continuity but should review new requirements and enforcement provisions.

• Expanded scope. The Act applies to processing of personal data by any controller or processor established in Nigeria, offering goods or services to Nigerian residents, or monitoring behavior occurring in Nigeria. This extraterritorial scope captures foreign organizations with significant Nigerian operations or customer bases.
• Legal basis requirements. Processing must be based on consent, contractual necessity, legal obligation, vital interests, public interest, or legitimate interests. The Act strengthens consent requirements including specific consent for sensitive personal data.
• Data subject rights. Nigerian data subjects have rights to access, rectification, erasure, restriction, data portability, and objection. Organizations must establish processes to receive and respond to rights requests within specified timeframes.
• Data protection impact assessments. High-risk processing activities require documented impact assessments evaluating risks to data subjects and mitigation measures before processing starts.

Nigeria Data Protection Commission

The Act establishes NDPC as an independent commission with full regulatory and enforcement powers, replacing the National Information Technology Development Agency NITDA as the primary data protection authority.

• Regulatory functions. NDPC issues regulations, guidelines, and codes of practice interpreting the Act and establishing sector-specific requirements. If you are affected, monitor NDPC publications for setup guidance.
• Enforcement powers. The Commission can investigate complaints, conduct audits, issue compliance orders, and impose administrative penalties. The Act significantly increases maximum penalties compared to NDPR.
• Registration requirements. Certain data controllers and processors must register with NDPC and maintain current registration information. Registration obligations depend on data processing volume and sensitivity.

Cross-Border Data Transfer Provisions

The Act establishes controls on international transfers of personal data from Nigeria, requiring either adequacy determinations for destination countries or appropriate safeguards approved by NDPC.

• Adequacy mechanism. NDPC can determine that specific countries or territories provide adequate protection for personal data, enabling transfers without additional safeguards.
• Alternative safeguards. Transfers to non-adequate jurisdictions require contractual clauses, binding corporate rules, or other approved mechanisms ensuring continued protection of personal data.
• Derogations. Limited derogations permit transfers in specific circumstances including explicit consent, contractual necessity, and public interest, subject to restrictions.

Compliance Implementation Steps

• Gap assessment. Compare current data protection practices against Act requirements, identifying areas requiring policy updates, process changes, or technical setups.
• Documentation updates. Revise privacy notices, data processing agreements, and internal policies to reflect Act requirements and NDPC guidance.
• Registration completion. Determine registration obligations and complete NDPC registration within specified timelines.
• Training programs. Educate staff on updated requirements and their roles in maintaining compliance.

Penalties and Enforcement Outlook

The Act establishes significant penalties for non-compliance, with administrative fines up to 2 percent of annual gross revenue or 10 million naira, whichever is higher. Criminal penalties apply to certain violations. If you are affected, focus on compliance given improved enforcement capabilities and NDPC stated intention to actively enforce the Act.

Similar analysis

Additional analysis covering similar themes.

Data Strategy · Credibility 73/100 · July 10, 2023

Data Strategy — Cross-border transfers

The EU adopted the EU-US Data Privacy Framework adequacy decision—Schrems III, anyone? Trans-Atlantic data transfers are legal again without SCCs, but privacy advocates are already preparing challenges.

Data Strategy · Credibility 73/100 · September 1, 2023

Data Strategy — Switzerland regulation

Switzerland's revised data protection law took effect September 1, 2023. Stronger requirements for data inventories, breach handling, and transparency—especially around profiling. If you process Swiss data, you are under…

Data Strategy · Credibility 73/100 · August 31, 2022

China data export

China’s Cyberspace Administration issued the first edition of outbound data transfer security assessment application guidelines on 31 August 2022, detailing submission materials, self-assessment requirements, and…

Data Strategy · Credibility 40/100 · August 3, 2022

India Withdraws Personal Data Protection Bill

India withdrew its long-debated Personal Data Protection Bill on 3 August 2022, resetting the legislative process and signaling that a broader Digital Personal Data Protection Bill would follow, affecting localization…

Data Strategy · Credibility 73/100 · April 29, 2024

United Kingdom policy

The UK Data Protection and Digital Information Bill completed its House of Commons stages, setting the pro-innovation reform package on course for House of Lords scrutiny and setup planning.

Continue in the Data Strategy pillar

Return to the hub for curated research and deep-dive guides.

Visit pillar hub

Latest guides

• Data Strategy Operating Model Guide

  Design a data strategy operating model that satisfies the EU Data Act, EU Data Governance Act, U.S. Evidence Act, and Singapore Digital Government policies with measurable…

• Data Interoperability Engineering Guide

  Engineer interoperable data exchanges that satisfy the EU Data Act, Data Governance Act, European Interoperability Framework, and ISO/IEC 19941 portability requirements.

• Data Stewardship Operating Model Guide

  Establish accountable data stewardship programmes that meet U.S. Evidence Act mandates, Canada’s Directive on Service and Digital, and OECD data governance principles while…

Coverage intelligence

Published

June 12, 2023

Coverage pillar

Data Strategy

Source credibility

73/100 — medium confidence

Topics

Nigeria regulation · Data protection · Cross-border transfers

Sources cited

3 sources (ndpc.gov.ng, statehouse.gov.ng, iso.org)

Reading time

5 min

Further reading

1. Nigeria Data Protection Act 2023 — Nigeria Data Protection Commission
2. President Bola Tinubu signs Data Protection Bill into law — State House, Federal Republic of Nigeria
3. ISO 8000-2:2022 — Data Quality Management — International Organization for Standardization