Nigeria Data Protection Regulation (NDPR) and Nigeria Data Protection Act (NDPA)
Overview
Nigeria's data protection framework comprises the Nigeria Data Protection Regulation (NDPR) issued by NITDA in January 2019, and the Nigeria Data Protection Act (NDPA) signed into law on June 12, 2023. The NDPA established the Nigeria Data Protection Commission (NDPC) as an independent regulatory body, replacing NITDA's oversight role. The NDPA applies to the processing of personal data by any data controller or processor that is domiciled, resident, or operating in Nigeria, or that processes personal data of data subjects in Nigeria.
Lawful Basis for Processing (NDPA Section 25)
| Lawful Basis |
Description |
| Consent |
Data subject has given consent to the processing for one or more specific purposes. Must be freely given, specific, informed, and unambiguous. |
| Contract |
Processing necessary for the performance of a contract to which the data subject is party. |
| Legal obligation |
Processing necessary for compliance with a legal obligation of the controller. |
| Vital interests |
Processing necessary to protect the vital interests of the data subject or another natural person. |
| Public interest |
Processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority. |
| Legitimate interests |
Processing necessary for legitimate interests of the controller or third party, provided the interests are not overridden by the data subject's rights. |
Data Subject Rights (NDPA Part IV)
| Right |
Description |
Response Period |
| Right to be informed |
Receive information about data processing at the point of collection |
At collection |
| Right of access |
Obtain confirmation of processing and a copy of personal data |
30 days |
| Right to rectification |
Correct inaccurate personal data |
30 days |
| Right to erasure |
Request deletion of personal data where no lawful basis for continued processing |
30 days |
| Right to restrict processing |
Request limitation of processing in certain circumstances |
30 days |
| Right to data portability |
Receive personal data in a structured, commonly used, machine-readable format |
30 days |
| Right to object |
Object to processing based on legitimate interests or public interest |
30 days |
| Right related to automated decision-making |
Not be subject to decisions based solely on automated processing that produce legal or significant effects |
30 days |
Sensitive Personal Data (NDPA Section 30)
The NDPA defines sensitive personal data as data relating to:
- Racial or ethnic origin
- Political opinions or affiliations
- Religious or philosophical beliefs
- Trade union membership
- Genetic data
- Biometric data for identification purposes
- Health data
- Sex life or sexual orientation
- Criminal convictions or offences
Processing of sensitive personal data requires explicit consent or is permitted under specific derogations (substantial public interest, employment obligations, vital interests, legal claims, health or social care purposes).
Cross-Border Transfer (NDPA Part VI)
Personal data may be transferred outside Nigeria where:
- Adequacy decision: The NDPC has determined that the receiving country or international organisation ensures an adequate level of data protection.
- Appropriate safeguards: Including binding corporate rules, standard contractual clauses approved by the NDPC, codes of conduct, or certification mechanisms.
- Derogations: Explicit consent, contract performance, public interest, legal claims, vital interests, or transfer from a public register.
The NDPC maintains a whitelist of countries with adequate protection. Controllers must conduct a transfer impact assessment and maintain records of all cross-border transfers.
Data Protection Compliance Organisation (DPCO)
Under the NDPR framework, organisations processing personal data of more than 2,000 data subjects in a 12-month period must engage a licensed Data Protection Compliance Organisation (DPCO) to conduct an annual data protection audit. The DPCO:
- Must be licensed by the NDPC (formerly NITDA)
- Conducts annual data protection audits
- Files the audit report with the NDPC
- Verifies compliance with the NDPR/NDPA
- Provides data protection advisory services
Data Protection Impact Assessment (NDPA Section 28)
Controllers must conduct a DPIA prior to processing that is likely to result in a high risk to data subjects' rights and freedoms, particularly:
- Systematic and extensive evaluation of personal aspects (profiling)
- Large-scale processing of sensitive personal data
- Systematic monitoring of a publicly accessible area
- Processing involving new technologies
DPIA results must be filed with the NDPC.
Breach Notification (NDPA Section 39)
| Requirement |
Detail |
| Notification to NDPC |
Within 72 hours of becoming aware of a personal data breach |
| Notification to data subjects |
Without undue delay where the breach is likely to result in a high risk to rights and freedoms |
| Content of notification |
Nature of breach, categories and approximate number of data subjects affected, name and contact of DPO, likely consequences, measures taken or proposed |
| Record keeping |
Document all breaches regardless of notification obligation |
Penalties (NDPA Section 46)
- Organisations processing data of more than 10,000 data subjects: up to 2% of annual gross revenue or NGN 10 million, whichever is greater.
- Organisations processing data of fewer than 10,000 data subjects: up to 1% of annual gross revenue or NGN 2 million, whichever is greater.
- Additional remedies include compensation orders, enforcement notices, and compliance orders.
Registration Requirement
Data controllers and processors must register with the NDPC. The registration includes:
- Description of categories of data subjects and personal data
- Purposes of processing
- Categories of recipients
- Description of cross-border transfers
- Retention periods
- Description of security measures
1---2name: nigeria-ndpr3description: Nigeria Data Protection Regulation (NDPR) and Nigeria Data Protection Act (NDPA) 2023 compliance. Covers lawful basis for processing, data subject rights, cross-border transfer mechanisms, Data Protection Compliance Organisation (DPCO) registration, mandatory DPIA filing, and breach notification. Keywords: NDPR, NDPA, Nigeria, NITDA, DPCO, Africa data protection, cross-border transfer.4license: Apache-2.05---67# Nigeria Data Protection Regulation (NDPR) and Nigeria Data Protection Act (NDPA)89## Overview1011Nigeria's data protection framework comprises the Nigeria Data Protection Regulation (NDPR) issued by NITDA in January 2019, and the Nigeria Data Protection Act (NDPA) signed into law on June 12, 2023. The NDPA established the Nigeria Data Protection Commission (NDPC) as an independent regulatory body, replacing NITDA's oversight role. The NDPA applies to the processing of personal data by any data controller or processor that is domiciled, resident, or operating in Nigeria, or that processes personal data of data subjects in Nigeria.1213## Lawful Basis for Processing (NDPA Section 25)1415| Lawful Basis | Description |16|-------------|-------------|17| Consent | Data subject has given consent to the processing for one or more specific purposes. Must be freely given, specific, informed, and unambiguous. |18| Contract | Processing necessary for the performance of a contract to which the data subject is party. |19| Legal obligation | Processing necessary for compliance with a legal obligation of the controller. |20| Vital interests | Processing necessary to protect the vital interests of the data subject or another natural person. |21| Public interest | Processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority. |22| Legitimate interests | Processing necessary for legitimate interests of the controller or third party, provided the interests are not overridden by the data subject's rights. |2324## Data Subject Rights (NDPA Part IV)2526| Right | Description | Response Period |27|-------|-------------|----------------|28| Right to be informed | Receive information about data processing at the point of collection | At collection |29| Right of access | Obtain confirmation of processing and a copy of personal data | 30 days |30| Right to rectification | Correct inaccurate personal data | 30 days |31| Right to erasure | Request deletion of personal data where no lawful basis for continued processing | 30 days |32| Right to restrict processing | Request limitation of processing in certain circumstances | 30 days |33| Right to data portability | Receive personal data in a structured, commonly used, machine-readable format | 30 days |34| Right to object | Object to processing based on legitimate interests or public interest | 30 days |35| Right related to automated decision-making | Not be subject to decisions based solely on automated processing that produce legal or significant effects | 30 days |3637## Sensitive Personal Data (NDPA Section 30)3839The NDPA defines sensitive personal data as data relating to:40- Racial or ethnic origin41- Political opinions or affiliations42- Religious or philosophical beliefs43- Trade union membership44- Genetic data45- Biometric data for identification purposes46- Health data47- Sex life or sexual orientation48- Criminal convictions or offences4950Processing of sensitive personal data requires explicit consent or is permitted under specific derogations (substantial public interest, employment obligations, vital interests, legal claims, health or social care purposes).5152## Cross-Border Transfer (NDPA Part VI)5354Personal data may be transferred outside Nigeria where:55561. **Adequacy decision**: The NDPC has determined that the receiving country or international organisation ensures an adequate level of data protection.572. **Appropriate safeguards**: Including binding corporate rules, standard contractual clauses approved by the NDPC, codes of conduct, or certification mechanisms.583. **Derogations**: Explicit consent, contract performance, public interest, legal claims, vital interests, or transfer from a public register.5960The NDPC maintains a whitelist of countries with adequate protection. Controllers must conduct a transfer impact assessment and maintain records of all cross-border transfers.6162## Data Protection Compliance Organisation (DPCO)6364Under the NDPR framework, organisations processing personal data of more than 2,000 data subjects in a 12-month period must engage a licensed Data Protection Compliance Organisation (DPCO) to conduct an annual data protection audit. The DPCO:6566- Must be licensed by the NDPC (formerly NITDA)67- Conducts annual data protection audits68- Files the audit report with the NDPC69- Verifies compliance with the NDPR/NDPA70- Provides data protection advisory services7172## Data Protection Impact Assessment (NDPA Section 28)7374Controllers must conduct a DPIA prior to processing that is likely to result in a high risk to data subjects' rights and freedoms, particularly:75- Systematic and extensive evaluation of personal aspects (profiling)76- Large-scale processing of sensitive personal data77- Systematic monitoring of a publicly accessible area78- Processing involving new technologies7980DPIA results must be filed with the NDPC.8182## Breach Notification (NDPA Section 39)8384| Requirement | Detail |85|-------------|--------|86| Notification to NDPC | Within 72 hours of becoming aware of a personal data breach |87| Notification to data subjects | Without undue delay where the breach is likely to result in a high risk to rights and freedoms |88| Content of notification | Nature of breach, categories and approximate number of data subjects affected, name and contact of DPO, likely consequences, measures taken or proposed |89| Record keeping | Document all breaches regardless of notification obligation |9091## Penalties (NDPA Section 46)9293- Organisations processing data of more than 10,000 data subjects: up to 2% of annual gross revenue or NGN 10 million, whichever is greater.94- Organisations processing data of fewer than 10,000 data subjects: up to 1% of annual gross revenue or NGN 2 million, whichever is greater.95- Additional remedies include compensation orders, enforcement notices, and compliance orders.9697## Registration Requirement9899Data controllers and processors must register with the NDPC. The registration includes:100- Description of categories of data subjects and personal data101- Purposes of processing102- Categories of recipients103- Description of cross-border transfers104- Retention periods105- Description of security measures
mukul975