| name | nigeria-ndpr |
| title | Nigeria Data Protection Regulation (NDPR) and Nigeria Data Protection Act (NDPA) |
| description | Nigeria Data Protection Regulation (NDPR) and Nigeria Data Protection Act (NDPA) 2023 compliance. Covers lawful basis for processing, data subject rights, cross-border transfer mechanisms, Data Protection Compliance Organisation (DPCO) registration, mandatory DPIA filing, and breach notification. Keywords: NDPR, NDPA, Nigeria, NITDA, DPCO, Africa data protection, cross-border transfer. |
| author | mukul975 |
| author_url | https://github.com/mukul975/Privacy-Data-Protection-Skills/tree/main/plugins/privacy-skills-complete/skills/nigeria-ndpr |
| license | Apache-2.0 |
| version | 0.1.0 |
| execution_mode | open |
| jurisdiction | ng |
| practice | data-protection |
| language | en |
Nigeria Data Protection Regulation (NDPR) and Nigeria Data Protection Act (NDPA)
Overview
Nigeria's data protection framework comprises the Nigeria Data Protection Regulation (NDPR) issued by NITDA in January 2019, and the Nigeria Data Protection Act (NDPA) signed into law on June 12, 2023. The NDPA established the Nigeria Data Protection Commission (NDPC) as an independent regulatory body, replacing NITDA's oversight role. The NDPA applies to the processing of personal data by any data controller or processor that is domiciled, resident, or operating in Nigeria, or that processes personal data of data subjects in Nigeria.
Lawful Basis for Processing (NDPA Section 25)
| Lawful Basis | Description |
|---|
| Consent | Data subject has given consent to the processing for one or more specific purposes. Must be freely given, specific, informed, and unambiguous. |
| Contract | Processing necessary for the performance of a contract to which the data subject is party. |
| Legal obligation | Processing necessary for compliance with a legal obligation of the controller. |
| Vital interests | Processing necessary to protect the vital interests of the data subject or another natural person. |
| Public interest | Processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority. |
| Legitimate interests | Processing necessary for legitimate interests of the controller or third party, provided the interests are not overridden by the data subject's rights. |
Data Subject Rights (NDPA Part IV)
| Right | Description | Response Period |
|---|
| Right to be informed | Receive information about data processing at the point of collection | At collection |
| Right of access | Obtain confirmation of processing and a copy of personal data | 30 days |
| Right to rectification | Correct inaccurate personal data | 30 days |
| Right to erasure | Request deletion of personal data where no lawful basis for continued processing | 30 days |
| Right to restrict processing | Request limitation of processing in certain circumstances | 30 days |
| Right to data portability |
