NIGERIA DATA PROTECTION ACT, 2023

NIGERIA DATA PROTECTION ACT, 2023

LAWS OF THE FEDERATION OF NIGERIA

ARRANGEMENT OF SECTIONS

PART I — OBJECTIVES AND APPLICATION

1.     Objectives

2.     Application

3.     Exemption of application

PART II — ESTABLISHMENT OF THE NIGERIA DATA PROTECTION COMMISSION, AND ITS GOVERNING COUNCIL

4.     Establishment of Nigeria Data Protection Commission

5.     Functions of the Commission

6.     Powers of the Constitution

7.     Independence of Commission

8.     Establishment of Governing Council of the Commission

9.     Appointment of members of the Council

10.    Tenure of members of the Council

11.    Cessation of Membership

12.    Functions powers of Council

13.    Conflict

PART III — APPOINTMENT OF THE NATIONAL COMMISSIONER, AND OTHER STAFF OF THE COMMISSION

14.    Appointment of the National Commissioner for the Commission

15.    Secretary to the Council

16.    Staff of the Commission

17.    Staff regulation discipline

18.    Pension

PART IV — FINANCIAL PROVISIONS

19.    Fund of the Commission

20.    Expenditure of Fund

21.    Power to borrow and accept gifts

22.    Account and audit

23.    Annual report estimates

PART V— PRINCIPLES AND LAWFUL BASIS GOVERNING PROCESSING OF PERSONAL DATA

25.    Lawful basis of personal data processing

26.    Consent

27.    Provision of information to data subject

28.    Data privacy impact assessment

29.    Obligations of data controller and data processor

30.    Sensitive personal data

31.    Children or person lacking the legal capacity to consent

32.    Data Protection Officers

33.    Data protection compliance

PART VI — RIGHTS OF A DATA SUBJECT

34.    Rights of a data subject

35.    Withdrawal of consent

36.    Right to object

37.    Automated decision making

38.    Data portability

PART VII — DATA SECURITY

40.    Personal data breaches

PART VIII — CROSS-BORDER TRANSFERS OF PERSONAL DATA

42.    Adequacy of protection

43.    Other bases for transfer of personal data outside Nigeria

PART IX — REGISTRATION AND FEES

44.    Registration of controllers and processors of major importance

45.    Fees and levies

PART X — ENFORCEMENT

46.    Complaints and investigations

47.    Compliance order

48.    Enforcement order

49.    Offences and penalties

50.    Judicial reviews

51.    Civil remedies

52.    Forfeiture

53.    Joint and vicarious liability

PART XI — LEGAL PROCEEDINGS

54.    Limitation of suit against the Commission

55.    Service of documents

56.    Restriction or execution against property of the Commission

57.    Indemnity of members, and employees of the Commission

58.    Power of arrest, search, and seize

59.    Right to appease the court

PART XII — MISCELLANEOUS PROVISIONS

60.    Directives by Minister

61.    Regulations

62.    Directives, codes and guidelines

63.    Priority of the law       

64.    Transitional provisions

65.    Interpretation

66.    Citation

NIGERIA DATA PROTECTION ACT, 2023

An Act to provide a legal framework for the protection of personal information, and establish the Nigerian Data Protection Commission for the regulation of the processing of personal information; and for related matters.

[COMMENCEMENT]                              [12TH DAY OF JUNE, 2023]

ENACTED by the National Assembly of the Federal Republic of Nigeria —

PART I — OBJECTIVES AND APPLICATION

1.     Objectives

The objectives of this Act are to —

(a)    safeguard the fundamental rights and freedoms, and the interests of data subjects, as guaranteed under the Constitution of the Federal Republic of Nigeria, 1999;

(b)    provide for the regulation of processing of personal data;

(c)    promote data processing practices that safeguard the security of personal data and privacy of data subjects;

(d)    ensure that personal data is processed in a fair, lawful and accountable manner;

(e)    protect data subjects’ rights, and provide means of recourse and remedies, in the event of the breach of the data subject’s rights;

(f)     ensure that data controllers and data processors fulfill their obligations to data subjects;

(g)    establish an impartial, independent, and effective regulatory Commission to superintend over data protection and privacy issues, and supervise data controllers and data processors; and

(h)    strengthen the legal foundations of the national digital economy and guarantee the participation of Nigeria in the regional and global economies through the beneficial and trusted use of personal data.

2.     Application

(1)    This Act shall apply to the processing of personal data, whether by automated means or not.

(2)    This Act shall apply, where the —

(a)    data controller or data processor is domiciled in, resident in, operating in Nigeria;

(b)    processing of personal data occurs within Nigeria; or

(c)    the data controller or the data processor is not domiciled in, resident in, or operating in Nigeria, but is processing personal data of a data subject in Nigeria.

TO READ MORE, DOWNLOAD

LAWS OF THE FEDERAL REPUBLIC OF NIGERIA

LAWS OF THE FEDERATION OF NIGERIA BY YEARS (MADE BETWEEN 1999-DATE)