Under the Nigeria Data Protection Act (NDPA) 2023, law enforcement requests can override consent-based processing through specific exemptions in Section 3, allowing data controllers to disclose personal data without data subject consent when compelled by competent authorities.
Legal Basis for Override
Valid requests from law enforcement (e.g., police, EFCC, or courts) for crime prevention, detection, investigation, or prosecution qualify as exemptions, provided they are necessary, proportionate, and issued via warrant, court order, or statutory power.
National security, public safety, or defense needs similarly permit disclosure, even if consent was the original basis, as these public interest tasks supersede individual consent under Section 25.
Compliance Requirements
Companies must verify the request’s legitimacy (e.g., official letterhead, legal authority) before complying, document the disclosure in the Record of Processing Activities (RoPA), and notify the data subject post-disclosure unless prohibited.
Withdrawal of consent does not retroactively invalidate prior disclosures made under such overrides.
