Data Strategy Briefing — June 12, 2023

Executive briefing: President Bola Tinubu signed Nigeria’s Data Protection Act 2023 into law on 12 June 2023, transforming the prior regulation into a statutory framework. The Act creates the Nigeria Data Protection Commission (NDPC) as the supervisory authority, mandates registration for certain controllers and processors, and codifies lawful bases, data subject rights, and penalties.

Key governance checkpoints

Registration obligations. Determine whether the organisation qualifies as a data controller or processor of major importance requiring NDPC registration.
Lawful processing. Map processing activities to the Act’s lawful bases and maintain records demonstrating compliance.
Cross-border transfers. Evaluate adequacy, contractual safeguards, or binding rules needed to export personal data, aligning with NDPC approval requirements.

Operational priorities

Rights management. Build intake channels and response playbooks for access, correction, portability, objection, and deletion requests within statutory timelines.
Breach notification. Implement incident response procedures to notify the NDPC within 72 hours of discovering a personal data breach.
Governance and staffing. Appoint data protection officers where required and embed NDPC reporting into corporate compliance programmes.

Enablement moves

Monitor NDPC regulations on registration thresholds, filing templates, and cross-border transfer approvals.
Engage with industry associations contributing to NDPC rulemaking and codes of practice.

Sources

Zeph Tech enables Nigerian enterprises to operationalise the Data Protection Act through registration readiness, rights automation, and cross-border transfer governance.