The Nigerian Communications Commission (NCC) released, on June 27, 2022, draft data protection (communication services) regulations and is requesting public comments on the same.

Scope

The draft regulations clarify that they provide a regulatory framework for the protection and privacy of data in the Nigerian communications sector, and apply to:

• licensees;
• subscribers;
• users; and
• other third parties directly or indirectly engaged with any of the above in respect of the processing of communications data.

Obligations

The draft regulations outline requirements regarding consent, including procedures for obtaining consent, and limitations on the use of the same. In addition, the draft regulations impose restrictions on the use of communication for direct marketing, such as automated calling, unsolicited calling, and text messages. Moreover, the draft regulations also outline retention periods for such communication data, highlighting that communication data should not be retained longer than necessary, having due consideration to the provisions of the Cybercrimes Act as it relates to the retention of traffic data and subscriber information.

In regard to data transfers, the draft regulations stipulate that a licensee may transfer a data subject's communications data to a third party were permitted by law or with the data subject's consent. In the case of cross-border transfers, a licensee can only transfer data outside Nigeria where the data protection regime in the recipient country has been determined by the NCC as providing sufficient and adequate protection. Moreover, the draft regulations provide data subjects with a right to data portability and require licensees to comply with a request at the latest within 30 days of the receipt of the same.

Next steps

Public comments can be submitted until July 20, 2023, via mail and be addressed to the Executive Vice Chairman of the NCC.

You can read the press release here and the draft regulations here.