Nigeria Data Protection Act, 2023
Sets a legal framework for protecting personal data and establishes the Nigeria Data Protection Commission to regulate how personal data is processed.
Where do you stand?
One reaction per bill — toggle the same button to clear.
In favour
0
0.0% of 0 reactions
Against
0
100.0%
The Act sets rules for any organisation that collects or uses personal data in Nigeria: how data may be processed, what rights a person has over their data, how breaches must be reported and when data may be sent abroad. It creates the Nigeria Data Protection Commission to enforce those rules and lets it order compensation to people harmed and impose fines on organisations that break the law.
Who this affects
Every person whose personal data is held by a company, government body or other organisation in Nigeria, and the organisations (data controllers and processors) that hold it.
What it changes
- 1Establishes the Nigeria Data Protection Commission and its Governing Council (Part II).
- 2Sets principles and lawful bases for processing personal data and gives data subjects rights, including to withdraw consent, object and data portability (Parts V and VI).
- 3A data controller must notify the Commission within 72 hours of becoming aware of a breach likely to risk people's rights and freedoms (s.40).
- 4Restricts transfers of personal data outside Nigeria unless the recipient country or arrangement gives adequate protection (Part VIII).
- 5The Commission may order compensation to a data subject and impose a penalty up to the greater of N10,000,000 and 2% of annual gross revenue for controllers of major importance (s.48).
6 sections
1.Objectives
The objectives of this Act are to — (a) safeguard the fundamental rights and freedoms, and the interests of data subjects, as guaranteed under the Constitution of the Federal Republic of Nigeria, 1999; (b) provide for the regulation of processing of personal data;
40(2).Personal data breaches
A data controller shall, within 72 hours of becoming aware of a breach which is likely to result in a risk to the rights and freedoms of individuals, notify the Commission of the breach
41(1).Basis for cross-border transfer of personal data
A data controller or data processor shall not transfer or permit personal data to be transferred from Nigeria to another country, unless — (a) the recipient of the personal data is subject to a law, binding corporate rules, contractual clauses, code of conduct, or certification mechanism that affords an adequate level of protection with respect to the personal data in accordance with this Act; or (b) one of the conditions set out in section 43 of this Act applies.
48(2)(b).Enforcement orders
An enforcement order made or sanction imposed under subsection (1) shall include — ... (b) ordering the data controller or data processor to pay compensation to a data subject, who has suffered injury, loss, or harm as a result of a violation;
48(4).Enforcement orders
The "higher maximum amount" shall be the greater of — (a) N10,000,000, and (b) 2% of its annual gross revenue in the preceding financial year.
48(5).Enforcement orders
The "standard maximum amount" shall be the greater of — (a) N2,000,000, and (b) 2% of its annual gross revenue in the preceding financial year.
This is a readable rendering for citizens. The authoritative text is the gazetted version — linked below.
Passed· Senate
3 May 2023
Date passed by the Senate, per the certification schedule in the Act's PDF.
Passed· House
24 May 2023
Date passed by the House of Representatives, per the certification schedule.
Assented
12 June 2023
Handwritten date beside the President's signature on the certification page.
Official text
The gazetted document
Today in the Assembly
Sittings, motions and divisions, day by day
See something wrong or missing?
No comments yet. Be the first.