The Nigeria Data Protection Act 2023: What Compliance Actually Requires

The Nigeria Data Protection Act 2023 (NDPA) is the country's first comprehensive data protection statute. It supersedes the Nigeria Data Protection Regulation 2019 as the primary instrument and establishes the Nigeria Data Protection Commission with a mandate to register, monitor and sanction.

Who the Act covers

The Act applies to any data controller or processor domiciled in Nigeria, resident in Nigeria, or processing personal data of data subjects in Nigeria. The extraterritorial reach mirrors the GDPR: a foreign company with Nigerian users falls within scope even without a local office.

Controllers and processors of major importance, a category defined by the volume of data processed and the sector involved, carry heavier obligations, including mandatory registration with the Commission and the appointment of a data protection officer.

Lawful bases and consent

Processing must rest on one of six lawful bases: consent, contract, legal obligation, vital interests, public interest, or legitimate interests. Consent must be freely given, specific, informed and unambiguous, and must be capable of withdrawal as easily as it was given. Bundled consent buried in terms of service will not satisfy the standard.

Importantly, legitimate interests is available under the NDPA, which gives organisations an alternative where consent is impractical. It is not a free pass: the interest must be balanced against the rights of the data subject and the assessment should be documented.

Data subject rights

The Act confers rights of access, rectification, erasure, restriction, portability and objection, along with a right not to be subject to solely automated decision-making with legal or similarly significant effects. Controllers must respond within a reasonable period, and must not charge for a first request.

Breach notification

Where a breach is likely to result in a risk to the rights and freedoms of individuals, the controller must notify the Commission within 72 hours of becoming aware of it. Where the risk is high, affected data subjects must also be notified directly and without undue delay. Maintaining an internal breach register is therefore not optional in practice, since the 72-hour clock runs from awareness, not from confirmation.

Cross-border transfers

Transfers outside Nigeria require an adequacy determination, appropriate safeguards such as binding corporate rules or standard contractual clauses, or one of the narrow derogations. Organisations relying on cloud infrastructure hosted abroad should confirm which mechanism their contracts actually invoke.

Enforcement

The Commission may issue compliance orders and impose sanctions. For a controller of major importance, penalties can reach the greater of a fixed sum or a percentage of annual gross revenue in the preceding financial year. Enforcement activity has grown steadily since the Commission became operational.

A practical starting point

Four steps cover most of the ground: map the data you hold and why; document a lawful basis for each processing activity; publish a privacy notice that reflects reality rather than a template; and put a breach response procedure in writing. Everything else builds on that foundation.