Nigeria: President Bola Tinubu signs the Nigeria Data Protection Act 2023 into law

On 14 June 2023, President Bola Tinubu signed the Nigeria Data Protection Act, 2023 into law, with the aim of addressing the critical need for data protection in the country.

In recent years, Nigeria has been criticised for failing to pass a data protection law while many other African countries have successfully done so. Instead, the country previously relied on the Nigeria Data Protection Regulation, 2019 (NDPR), released by the National Information Technology Development Agency (NITDA), which has now been replaced by the Data Protection Act. Several sections of the Act focus on the safeguards required during the processing of personal information. Section 24 of the Act emphasises the principles governing the processing of personal data and mandates data controllers and processors to collect data lawfully and process it securely. Section 25 provides the lawful basis for personal data processing, requiring the consent of the data subject for specific purposes. The legislation further outlines the rights of data subjects in sections 34 – 37, ensuring that individuals have control over their personal information. The Act prohibits the cross-border transfer of personal data, except when legally permitted, and enhances accountability by mandating all data controllers and processors who are considered of “significant importance” to register with the regulatory authority within six months of the law’s commencement.

...