The Nigeria Data Protection Act (NDPA) 2023 provides a comprehensive legal framework for protecting personal data in Nigeria, replacing the Nigeria Data Protection Regulation (NDPR) of 2019. The law aims to safeguard the fundamental rights of data subjects, regulate data processing, and strengthen Nigeria’s digital economy.
Key provisions of the NDPA include:
Regulatory body
- Nigeria Data Protection Commission (NDPC): The Act establishes the NDPC as an independent and effective supervisory authority to regulate and enforce data protection in the country.
- Powers of the NDPC: The commission is empowered to create guidelines, investigate breaches, conduct audits, and impose sanctions for non-compliance.
Scope of application
- Territorial reach: The NDPA applies to all public and private organizations within Nigeria and has extraterritorial reach, applying to any foreign entity processing the personal data of Nigerian residents.
- Exemptions: Processing data for personal or household use, national security, law enforcement, journalism, public health, or legal claims are largely exempt.
Data processing principles
Organizations must adhere to core principles when processing data, including:
- Lawfulness, fairness, and transparency: Processing must be done legally and transparently.
- Purpose limitation: Data must be collected for a specific, explicit, and legitimate purpose.
- Data minimization and accuracy: Only the minimum data necessary for the stated purpose should be collected and kept accurate.
- Storage limitation: Data must not be kept longer than necessary.
- Integrity and confidentiality: Personal data must be secured against unauthorized access and breaches.
Lawful basis for processing
Personal data can be processed if there is a legal basis, such as consent, contractual necessity, legal obligation, legitimate interest, vital interest, or public interest.
Data subject rights
Individuals have rights including accessing, correcting, or erasing their data, withdrawing consent, objecting to processing, and data portability.
Cross-border data transfers
Transferring personal data outside Nigeria is restricted to countries with adequate protection or with appropriate safeguards.
Sanctions and penalties
The NDPA includes a tiered penalty system for non-compliance, with higher fines for “Data Controllers and Processors of Major Importance”.
Impact on the NDPR
The NDPA takes precedence over the NDPR in case of inconsistencies, but existing NDPR orders and regulations remain until replaced
