🇳🇬Child's Right Act, 2003

← Back to laws in Nigeria

Child privacy as part of child welfare and dignity

The Child's Right Act, 2003 is not a general data protection statute. It is a child rights and welfare law. But it matters deeply for privacy because it recognises the best interests of the child, the child's dignity, private and family life, protection from exploitation and confidentiality in proceedings involving children.

For organisations processing children's data in Nigeria, the Act should be read alongside the NDPA and GAID. The NDPA supplies the general personal data framework. The Child's Right Act supplies the child-centred lens: best interests, welfare, protection, participation, dignity and confidentiality.

Best interests first

Section 1 makes the best interest of the child the primary consideration in every action concerning a child, whether undertaken by an individual, public or private body, institution, service, court, administrative authority or legislative authority. This is the central interpretive rule.

That principle matters for data processing. A product, school, health provider, platform or public authority handling children's information should not ask only whether it has a lawful basis under the NDPA. It must also ask whether the processing is consistent with the child's best interests and well-being.

Right to private and family life

The Act incorporates fundamental rights and gives children additional statutory rights. Section 8 recognises the child's right to private and family life. That right is broader than a database rule. It protects the child's personal sphere, family relationships, identity, dignity and safety.

Where children's data is processed for education, health, social welfare, identity verification, online services, custody, adoption, justice or care proceedings, privacy should be treated as part of the child's welfare. Publication, disclosure, profiling and unnecessary collection can affect a child long after the immediate service has ended.

Confidentiality in proceedings involving children

The Act contains strong protections for children involved in court proceedings. Section 156 excludes persons not directly concerned from attending court. Section 157 prohibits publication of a child's name, address, school, photograph or anything likely to identify a child whose matter is before the court, except where required by the Act. Breach of this prohibition is an offence.

This is one of the Act's clearest privacy rules. It recognises that children involved in legal proceedings face special risk from publicity. For media houses, NGOs, schools, law firms, police-facing platforms, social workers and digital case management systems, this means identifying information about children in proceedings must be handled with strict confidentiality.

Health, education and welfare contexts

The Act recognises rights to health and health services, education, parental care, protection and maintenance. These are not only welfare rights; they generate data flows. Schools, hospitals, social services, child protection agencies and care institutions handle sensitive information about children every day.

Under a modern privacy analysis, those institutions should connect the Act's child rights obligations to NDPA controls: purpose limitation, minimisation, security, access, parental or guardian authority where appropriate, and restrictions on disclosure. Child-related data should not be collected simply because it is convenient or because a form has always asked for it.

Protection from exploitation and harmful disclosure

The Act prohibits child marriage, exploitative labour, trafficking, sexual abuse, harmful publications and other forms of exploitation. These provisions are not written as data protection clauses, but they matter for digital services and data-driven abuse. Information about a child can enable targeting, grooming, trafficking, blackmail, reputational harm or discriminatory treatment.

Any organisation that processes child data should therefore treat security and access control as child protection measures. Data leaks involving children are rarely just technical incidents. They may create physical, psychological, social and reputational risks.

How the Act connects with NDPA compliance

The NDPA and GAID provide the operational privacy framework. The Child's Right Act adds a stricter child-centred standard. Where an organisation processes child data, lawful basis and consent are not enough. The organisation should also assess whether the processing is in the child's best interests, whether less data could be used, whether access is restricted, whether publication risks exist, and whether children or guardians are given age-appropriate information.

For online services, this means careful design of child-facing forms, age gates, parental or guardian controls, default privacy settings, marketing restrictions and breach response. For schools, hospitals and social services, it means privacy-by-design in records, access control, referrals, reporting and case management.