🇳🇬Nigeria Data Protection Regulation 2019

← Back to laws in Nigeria

Nigeria's first broad data protection rulebook

The Nigeria Data Protection Regulation 2019 was issued by NITDA as Nigeria's first broad operational privacy framework. It was designed to safeguard the rights of natural persons to data privacy, foster safe conduct for transactions involving personal data, prevent manipulation of personal data, and help Nigerian businesses remain competitive in international trade through a data protection framework aligned with best practice.

The NDPR has now been overtaken as the central legal instrument by the Nigeria Data Protection Act, 2023 and the GAID. But it remains important because many Nigerian privacy practices, templates and compliance programmes were originally built around it. Understanding the NDPR helps explain why privacy policies, annual audits, DPCO-led compliance, foreign transfer assessments and privacy notices became standard features of Nigerian data protection practice.

Scope — wide coverage for personal data processing

The Regulation applied to all transactions intended for the processing of personal data, regardless of the means by which processing was conducted or intended to be conducted, in respect of natural persons in Nigeria. It also applied to natural persons residing outside Nigeria who are Nigerian citizens. That territorial framing was broad and rights-oriented.

The Regulation did not operate as a ceiling on privacy rights. It expressly stated that it should not deny any Nigerian or natural person privacy rights available under any other law, regulation, policy or contract in force in Nigeria or a foreign jurisdiction. This was an important interpretive point: the NDPR was framed as a floor for protection, not as a limit on stronger rights.

The governing principles — purpose, minimisation, accuracy, retention and security

Part 2.1 required personal data to be collected and processed for a specific, legitimate and lawful purpose consented to by the data subject. Data had to be adequate, accurate and handled without prejudice to human dignity. It could be stored only for the period reasonably needed and had to be secured against foreseeable hazards and breaches such as theft, cyberattack, viral attack, manipulation, fire, rain or other natural elements.

The Regulation also imposed a duty of care and accountability on anyone entrusted with, or in possession of, personal data. This made the NDPR more than a notice-based instrument. It treated possession of personal data as a responsibility that could trigger consequences for acts and omissions.

Lawful processing and consent

Part 2.2 recognised lawful processing where at least one basis applied: consent, performance of a contract, compliance with legal obligation, protection of vital interests, or performance of a task in the public interest or exercise of official public mandate vested in the controller.

Part 2.3 dealt with procuring consent. No data could be obtained unless the specific purpose of collection was made known to the data subject. Where processing was based on consent, the controller had to be able to demonstrate that the data subject consented and had legal capacity to give consent. Consent requests had to be distinguishable from other matters, intelligible, accessible, and written in clear language. The data subject had to be told of the right and method to withdraw consent before consent was given.

Privacy policy and transparency

The NDPR required a clear and publicly available privacy policy. The policy had to communicate material information about the controller, the personal data being collected, purposes of processing, third-party access, available remedies, timeframe for remedy and the principles governing processing. Importantly, a limitation clause could not protect a data controller acting in breach of the principles of the Regulation.

This is where many Nigerian privacy programmes began: privacy policies became operational documents rather than generic website statements. The policy was expected to explain what the organisation actually did with data and how data subjects could obtain remedies.

Security, processors and objections

Part 2.6 required anyone involved in data processing or control to develop security measures, including protection from hackers, firewalls, secure storage, access controls, encryption, organisational policies, secure email systems and continuous capacity building.

Part 2.7 required third-party processing to be governed by a written contract between the third party and the data controller. The data controller remained responsible for ensuring that any person engaged to process personal data complied with the Regulation.

Part 2.8 protected the data subject's right to object. The data subject had to be able to object to processing for marketing purposes and had to be expressly offered a free mechanism for objection to any form of data processing.

Transfers and penalties

Part 2.11 subjected transfers to a foreign country or international organisation to the Regulation's transfer provisions and supervision by the Honourable Attorney General of the Federation. Transfers could proceed where adequate protection was determined, with attention to the legal system of the foreign country, rule of law, human rights, relevant legislation and access by public authorities.

Part 2.10 created significant penalty exposure. For data controllers dealing with more than 10,000 data subjects, the penalty was 2% of annual gross revenue of the preceding year or 10 million Naira, whichever was greater. For controllers dealing with fewer than 10,000 data subjects, the penalty was 1% of annual gross revenue of the preceding year or 2 million Naira, whichever was greater.