Support Centre



Law: Nigerian Data Protection Act, 2023 (the Act)

Regulator: the Nigeria Data Protection Commission (NDPC)

Summary: On June 14, 2023, the President of Nigeria signed the Act which provides a legal framework for the protection of personal information and establishes the NDPC. In particular, the Act in line with international standards establishes principles for the processing of personal data, outlining specific requirements for the processing of sensitive and children's data.

In addition, the Act creates requirements for data controller including the conducting of Data Protection Impact Assessments, the appointment of a data protection officer, breach notification, and data security requirements. Moreover, the Act imposes restrictions on cross border transfers, while adopting the concept of adequate protection. Furthermore, data subjects are provided with rights including right to object, withdraw consent, data portability, and the right not to be subject to a decision based solely on automated processing of personal data.


On June 12, 2023, the Nigeria Data Protection Bill was signed into law by President Bola Ahmed Tinubu. Tiwalola Osazuwa, Peretimi Pere, Nenjom Asuk, and Ifeoluwa Ebiseni, from Aelex Partners, look at the key provisions of the Act, including its scope and applicability and penalties for non-compliance.

The National Information Technology Development Agency ('NITDA') released, on 4 October 2022, a draft Data Protection Bill, 2022 ('the Bill'). This Insight provides an overview of the Bill including key provisions and obligations applicable to the processing of personal data. The Bill introduces new data processing principles such as fairness, transparency, as well as accountability, and creates a new Nigeria Data Protection Commission ('the Commission'). In the last decade, there have been some attempts for a new Data Protection Bill such as the Data Protection Bill 2020, which went through a request of public comments and a validation workshop held in September 2020 but has since been abandoned.