The term “Data privacy and Protection Act” most recently and specifically refers to the Nigeria Data Protection Act (NDPA) 2023, which became law in June 2023. This act provides a legal framework for data protection in Nigeria, establishing the Nigeria Data Protection Commission (NDPC) to enforce its provisions. Its main objectives are to protect individuals’ rights regarding their personal data, regulate how organizations collect and process it, and give legal backing to data privacy as a fundamental right.
Key provisions and objectives
- Legal framework: The act provides a comprehensive legal framework for data protection in Nigeria, replacing previous regulations like the Nigerian Data Protection Regulation (NDPR) 2019.
- Establishment of NDPC: It establishes the Nigeria Data Protection Commission (NDPC) as the independent regulatory body to oversee data protection and enforce the rules.
- Protection of rights: The act aims to protect the fundamental rights and freedoms of data subjects, ensuring personal data is processed in a fair, lawful, and transparent manner.
- Regulation of data processing: It regulates the collection, use, and transfer of personal data by organizations operating in Nigeria, and also applies to foreign entities that process the data of individuals in Nigeria.
- Data subject rights: It recognizes specific rights for data subjects and provides mechanisms for them to seek redress for breaches.
- Compliance obligations: The act imposes compliance obligations on businesses and requires certain large data processors to appoint a Data Protection Officer (DPO).
Applicability
- The NDPA applies to any entity processing the personal data of individuals in Nigeria, regardless of the entity’s location.
- It protects the data privacy of Nigerian citizens and residents.
Principles and obligations
- Fairness and transparency: Data must be processed in a fair, lawful, and transparent manner.
- Purpose limitation: Data should be collected for a specific, explicit, and legitimate purpose and not processed further in a manner inconsistent with those purposes.
- Security: Organizations must take measures to securely store and process personal data to protect it from loss, theft, or unauthorized access
Download Data privacy and Protection Act
-
UPDATES | ADVISORY | COMPLIANCE | NEWS
Nigeria Data Protection (Amendment) Bill, 2026: All you need to know.
A major debate is currently trending in the data protection space regarding the controversial Nigeria Data Protection Amendment Bill. The proposed bill, sponsored by Senator Ned Nwoko, seeks to introduce strict adjustments to how international tech companies handle Nigerian user data. The most heavily searched aspect of this bill is a mandate requiring every social […]
-
EVENTS | INTERNATIONAL | NEWS | UPDATES
ISACA Honours NDPC for Distinguished Regulatory Leadership in Nigeria
The Nigeria Data Protection Commission has received the Industry Leader Regulator Recognition Award from the ISACA Lagos Chapter during its 30th-anniversary celebration in Lagos. The ISACA Lagos Chapter honored the commission for its distinguished leadership, resilience, and commitment to building a trusted digital ecosystem in Nigeria. Ms. Omoikhefe Ahimie, the commission’s Lagos Liaison Officer, received […]
-
ADVISORY | COMPLIANCE | NEWS
Why non-compliant Businesses Are Being Locked Out of Government and Corporate Contracts
In business data protection compliance certificate is no longer just a regulatory formality—it is a mandatory license to do business. Across the globe, governments and major corporations are actively severing ties with third-party vendors, suppliers, and contractors who cannot prove their data protection compliance. If your organization lacks a valid data protection registration certificate, you […]
-
Fake Compliance Scams Target Small Businesses: How to Verify Your Data Protection Status for Free
As regulatory bodies crack down on data privacy violations, a rising wave of predatory compliance scams is targeting small businesses, charities, and independent professionals across the country. Fraudulent actors, posing as official agents, are demanding exorbitant fees for “mandatory” data protection registration certificates—fees that many struggling organizations simply cannot afford in today’s harsh economic climate. […]
-
The Beginner’s Guide to Renewing Your NDPC Data Protection Registration under the NDPA 2023
If your business collects, stores, or processes the personal data of up to 200 or more Nigerians within a six-month period—whether it’s customer phone numbers, BVNs, email addresses, or employee payroll—you are legally classified as a data controller or data processor. Under the Nigeria Data Protection Act (NDPA) 2023, managing this data comes with strict […]
-
ADVISORY | COMPLIANCE | DATA BREACH | INTERNATIONAL | NEWS | UPDATES
Multiple Nigerian Communications Commission Web Servers Compromised by Threat Actors
The Nigerian Communications Commission (NCC) is facing a significant security incident following a cyberattack that successfully compromised at least two of its public-facing web servers. Threat actors breached the infrastructure hosting consumer.ncc.gov.ng (the NCC Consumer Affairs bureau portal) and csirt.ncc.gov.ng (the official portal for the NCC’s Computer Security Incident Response Team). The irony of the […]
