Nigeria’s data protection policy is primarily governed by the Nigeria Data Protection Act (NDPA) of 2023, which establishes the legal framework for protecting personal data and creates the Nigeria Data Protection Commission (NDPC). This act replaced the previous Nigeria Data Protection Regulation (NDPR) and outlines data protection principles, individual rights like the right to access and rectification, and the responsibilities of data controllers and processors. Key principles require data to be collected with consent for a specific, lawful purpose and to be secured against breaches.
Key aspects of the policy
- Establishment of the NDPC: The Act creates the NDPC to enforce data protection rules and supervise data processing activities.
- Data Protection Principles: Data must be collected and processed for specific, legitimate purposes with the data subject’s consent. It must be adequate, accurate, and stored only as long as necessary.
- Security Measures: Organizations are required to take reasonable technical and organizational measures to prevent the loss, misuse, or alteration of personal data.
- Individual Rights: The NDPA grants individuals rights, including:
- The right to be informed about how their data is processed.
- The right to access their data.
- The right to rectify inaccurate data.
- The right to object to processing, including direct marketing.
- The right to data portability.
- The right to have their data erased.
- The right not to be subject to decisions based solely on automated processing.
- Scope: The Act applies to any person or entity processing personal data in Nigeria, with specific exemptions for certain activities like crime prevention and national security.
- Consent and Children: Parental or legal guardian consent is required before processing the data of children under 18.
- Data Audits and Policies: Organizations are required to conduct data protection audits and have clear data protection policies in place.
