🇳🇬Nigeria Data Protection Act, 2023

← Back to laws in Nigeria

Nigeria's primary data protection statute

The Nigeria Data Protection Act, 2023 is now the central legal framework for personal information protection in Nigeria. It establishes the Nigeria Data Protection Commission and gives statutory force to a national privacy regime that had previously relied heavily on the NDPR and administrative enforcement.

The Act is not merely a rebranding of the NDPR. It creates a statutory regulator, sets the hierarchy for conflicting laws, defines controller and processor obligations, recognises lawful bases, establishes data subject rights, regulates cross-border transfers and introduces the concept of data controllers and processors of major importance.

Application and institutional structure

The Act applies to processing of personal data where the controller or processor is domiciled, resident or operating in Nigeria, and also where a controller or processor not domiciled in Nigeria processes personal data of data subjects in Nigeria. GAID clarifies that “operating in Nigeria” includes targeting a data subject in Nigeria, even where the controller or processor is not domiciled or resident in Nigeria.

The Act establishes the Nigeria Data Protection Commission as the independent authority for supervising and enforcing data protection law. The Commission's functions include regulating personal data processing, promoting public awareness, registering controllers and processors of major importance, issuing guidance, receiving complaints, conducting investigations and applying enforcement measures.

Principles — the operating standard for all processing

Section 24 sets out the principles of personal data processing. Personal data must be processed in a fair, lawful and transparent manner. It must be collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes. It must be adequate, relevant and limited to what is necessary. It must be accurate and kept up to date. It must not be retained longer than necessary and must be processed with integrity, confidentiality and security.

These principles are the benchmark for every compliance decision. A processing activity can have a lawful basis and still fail if it collects excessive data, hides the real purpose, keeps records indefinitely, or uses weak security. The Act therefore requires both legal justification and operational discipline.

Lawful bases and consent

Section 25 provides the lawful bases for processing. These include consent, performance of a contract, compliance with a legal obligation, protection of vital interests, performance of a task in the public interest or exercise of official authority, and legitimate interests. Legitimate interest is not a shortcut: GAID requires a cautious assessment, documentation and a legitimate interest assessment where it is relied upon.

Section 26 governs consent. Consent must be capable of being demonstrated and should be freely given, specific, informed and unambiguous. Where consent is used, it should not be bundled into unrelated terms or made a condition for a service where the processing is unnecessary for that service. Consent can be withdrawn, and withdrawal should not affect processing that occurred lawfully before withdrawal.

Information to data subjects and rights

Section 27 requires information to be provided to data subjects in clear and accessible form. GAID explains that this should include the identity of the controller or processor, lawful basis, types of personal data, purpose, means of processing, authorised third-party access, data subject rights, internal remediation contact and the right to complain to the Commission.

The Act recognises rights such as access, rectification, erasure or the right to be forgotten, data portability, objection, withdrawal of consent, complaint to the Commission and judicial remedy. These are not merely statements for privacy policies. They require workflows: identity verification, response tracking, escalation, processor coordination and audit evidence.

Data controllers and processors of major importance

One of the Act's major innovations is the category of data controllers and data processors of major importance. GAID classifies major data processing into Ultra-High Level, Extra-High Level and Ordinary-High Level. The assessment considers risk to data subjects, data sovereignty implications, sensitivity of data, financial assets, cloud reliance, cross-border data flows, automation, number of data subjects and significance to Nigeria's economy, society or security.

Controllers and processors of major importance may have registration obligations, annual compliance audit return obligations, DPO obligations, semi-annual reports and additional governance duties. Organisations should not wait for enforcement to decide whether they fall into this category. The classification should be part of the initial compliance assessment.

DPIAs, DPOs, security and breach response

The Act requires data privacy impact assessments where processing may result in high risk to data subjects. GAID gives the DPIA framework and treats high-risk processing, emerging technologies, profiling, behavioural monitoring and vulnerable data subjects as areas that require closer scrutiny.

Data protection officers are mandatory for relevant controllers and processors, particularly major data processing entities. GAID requires the DPO to be properly supported, resourced, involved in all personal data processing issues and protected from coercion or penalty for performing data protection tasks.

Security is not merely technical. The Act and GAID require monitoring, evaluation and maintenance of systems, training, privacy by design and evidence of compliance. Breach notification requires prompt internal escalation, assessment and reporting to the Commission where required.

Cross-border transfers and legal hierarchy

The NDPA regulates transfers of personal data outside Nigeria and requires mechanisms that protect data subjects. GAID provides detailed guidance on cross-border transfer, including adequacy, contractual safeguards, risk assessment and evidence of compliance.

Section 63 is especially important. Where another law or enactment relates directly or indirectly to personal data processing and is inconsistent with the NDPA, the NDPA prevails. This gives the Act priority in cases of overlap with sectoral instruments, unless the issue is outside its material scope.