The main data protection law in Nigeria is the Nigeria Data Protection Act 2023 (NDPA), which establishes the Nigeria Data Protection Commission (NDPC) as the regulatory body. It replaces the 2019 regulations and provides a comprehensive legal framework for the protection of personal data, based on principles like fairness, lawfulness, transparency, and data minimization. The Act sets out obligations for data controllers and processors and outlines penalties for non-compliance.
Key aspects of the NDPA 2023:
- Regulatory Body: The Act establishes the Nigeria Data Protection Commission (NDPC) to oversee and enforce data protection rules.
- Core Principles: Data processing must adhere to principles of lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, and integrity and confidentiality.
- Data Subject Rights: It protects the fundamental rights and freedoms of individuals whose data is being processed.
- Data Controller and Processor Obligations: Organizations must implement security measures, be accountable, and fulfill their obligations to data subjects.
- Child Data: Parental or legal guardian consent is required to process a child’s personal data, with specific measures for verification.
- Penalties: The Act provides for fines and other penalties for non-compliance, which can be based on the size of the company.
Other related laws:
- Cybercrimes (Prohibition, Prevention Etc) Act 2015: This Act provides a legal framework for prosecuting cybercrimes and requires financial institutions to retain and protect data.
- National Health Act 2014: This Act restricts the disclosure of personal information of health service users and requires healthcare providers to safeguard such data.
- Freedom of Information Act 2011: This act also contains provisions for the protection of personal privacy.
