On June 12 2023, the Data Protection Bill 2023 (now the Data Protection Act 2023) was enacted into law, providing new legal protections for personal data in Nigeria. The bill also established the Nigeria Data Protection Commission (NDPC), led by a National Commissioner, Dr Vincent Olatunji, previously the National Commissioner of the Nigeria Data Protection Bureau (NDPB).
The Nigerian Data Protection Act gives individuals more control over their data and enhances privacy when using the internet. The implementation of certain parts of the law has been left to the discretion of the newly established NDPC.
The law establishes principles of data processing for controllers and processors and provides six legal bases for processing personal data. Individuals have a range of rights over their data, including the right to know what data is collected and who else has access to it, the right to rectify or erase data, and the right to object to the use of their data for marketing purposes.
Transferring personal data outside Nigeria is only permitted if the recipient is subject to a law or other safeguard that provides an “adequate” level of protection, unless one of the law’s specific exceptions applies. The bill also requires companies to report data breaches and notify affected individuals in certain cases. Sanctions for violations include fines and financial compensation to data subjects.
Overall, the law aims to strengthen data protection in Nigeria, giving individuals greater control over their personal information and fostering a more secure online environment.
