Loading content
Data Protection
The NDP Act 2023 governs the processing of personal data in Nigeria, establishes the Nigeria Data Protection Commission, and gives people rights over information held about them.
Nigeria Data Protection Act 2023
Our explanation, written for a general reader. It is not the text of the law.
The Act put data protection on a statutory footing and created the Nigeria Data Protection Commission as regulator. It applies to processing carried out in Nigeria and, in defined circumstances, to processing of data of people in Nigeria from outside it.
Its architecture is principled rather than mechanical. Personal data must be processed lawfully, fairly and transparently, collected for specified purposes, limited to what is necessary, kept accurate, retained no longer than needed, and secured. A business that can answer 'why do we hold this, and for how long' is most of the way there.
Consent is one lawful basis among several — contract, legal obligation, vital interests, public interest and legitimate interests also appear. Choosing the right basis up front is what keeps a privacy notice honest, and the Act gives individuals rights of access, rectification, erasure and objection that a business must be able to service.
Where the official text lives, beside what it means in ordinary language.
Official text
The Commission
Nigeria Data Protection Act 2023 — establishment of the Nigeria Data Protection Commission
Plain language — our explanation
The Act establishes the Commission as the regulator responsible for data protection in Nigeria.
Official text
Principles of processing
Nigeria Data Protection Act 2023 — principles
Plain language — our explanation
Processing must be lawful, fair and transparent, purpose-limited, adequate and not excessive, accurate, retained only as long as necessary, and appropriately secured.
Official text
Lawful basis
Nigeria Data Protection Act 2023 — lawful basis for processing
Plain language — our explanation
Every act of processing needs a basis in the Act. Consent must be freely given and capable of being withdrawn; it is not the only route, and not always the best one.
Official text
Rights of data subjects
Nigeria Data Protection Act 2023 — rights of data subjects
Plain language — our explanation
People have rights over data about them, including access, correction, deletion in defined circumstances, and objection to certain processing.
In real life
A shop collects customers' phone numbers for delivery and later uses them for marketing blasts.
The purpose has changed. Purpose limitation and the basis for the new use are the questions, and a privacy notice written at collection is what answers them.
In real life
A former customer asks a company to delete everything it holds about them.
The company needs a process: identify what it holds, apply the Act's rights and exceptions, and respond. 'We do not know what we hold' is not an answer.
What you should do
What you should not do
“Data protection only applies to big technology companies.”
The Act is about processing personal data, not company size. A small business with a customer list is processing personal data.
“A privacy policy on the website is compliance.”
A notice describes the practice. If the practice does not match the notice, the notice is the evidence against you.
What this instrument was, what changed, and what is in force now. Superseded versions are kept on the record rather than deleted.
What changed
The change from a regulation to an Act matters: obligations now sit in primary legislation, with a dedicated regulator behind them.
What changed
What changed
When to speak to a lawyer