Rights
The Nigeria Data Protection Act 2023 created a statutory commission and replaced the 2019 regulation
The NDPA 2023 is Nigeria's first primary data protection statute, superseding the NDPR 2019 issued by NITDA. It establishes the Nigeria Data Protection Commission, requires a lawful basis for processing, mandates data protection officers for higher-risk controllers, and provides for sanctions calculated on gross annual revenue.
Key rules
- Jurisdiction โ Nigeria Data Protection Commission; enforcement orders reviewable in the Federal High Court.
Governing law
- Nigeria Data Protection Act, 2023 โ Creates the NDP Commission; registration for controllers of major importance; revenue-based penalties.
- Nigeria Data Protection Regulation, 2019 โ Predecessor NITDA instrument.
In practice
Before 2023 Nigerian data protection rested on the Nigeria Data Protection Regulation 2019, a subsidiary instrument of NITDA whose legal foundation was contested. The Nigeria Data Protection Act 2023 puts the framework on a statutory footing and creates the Nigeria Data Protection Commission as an independent regulator with investigative and enforcement powers. It sets out lawful bases including consent, contract, legal obligation, vital interests and legitimate interests; requires that consent be freely given, specific and revocable; and grants data subject rights of access, rectification, erasure, restriction, objection and portability. Controllers of major importance must register with the Commission and appoint a data protection officer. Cross-border transfers require an adequate destination or an approved mechanism. Sanctions for data controllers of major importance can reach the greater of a fixed sum or 2% of gross annual revenue in the preceding year.