Nigeria Data Protection Act, 2023
Federal law establishing the Nigeria Data Protection Commission and setting principles, lawful bases, rights, safeguards, breach duties, international transfer conditions, major-importance registration and enforcement for personal-data processing.
Overview
Federal law establishing the Nigeria Data Protection Commission and setting principles, lawful bases, rights, safeguards, breach duties, international transfer conditions, major-importance registration and enforcement for personal-data processing.
Applies to automated and non-automated personal-data processing under section 2 territorial rules, subject to personal/household and limited purpose-based exclusions in section 3. Regulatory details and certain obligations depend on rules, notices or individual Commission orders not reproduced in this single official Act.
Obligations
Requirements identified from this policy that may need to be tracked by your organization.
4 identified
4 identified obligations
Process data fairly, lawfully and transparently
Controllers and processors must ensure all personal data is processed fairly, lawfully and transparently. Imported research notes (check before approving): • Duty holders (any one of): data controller; data processor • Timing in the source: "processed in a fair, lawful and transparent manner" • Further quotation: "This Act shall not apply to the processing of personal data carried out by one or more persons solely for personal or household purposes" (Section 3) • Further quotation: "This Act shall apply, where the — (a) data controller or data processor is domiciled in, resident in, or operating in Nigeria ; (b) processing of personal data occurs within Nigeria ; or (c) the data controller or the data processor is not domiciled in, resident in, or operating in Nigeria, but is processing personal data of a data subject in Nigeria." (Section 2) • Further quotation: "A data controller or data processor shall ensure that personal data is" (Section 24)
OtherContinuousSource: Section 24 · Section 24 · page 16Suggested owner: Privacy Lead
Specify purposes and limit incompatible further processing
Controllers and processors must collect personal data for specified, explicit and legitimate purposes and not further process it incompatibly; assess compatibility using the considerations in section 24(4), noting the research, statistical and public-interest archiving provision. Imported research notes (check before approving): • Duty holders (any one of): data controller; data processor • Timing in the source: "collected for specified, explicit, and legitimate purposes, and not to" • Exception: Further processing for archiving in the public interest, scientific or historical research or statistical purposes is not considered incompatible under section 24(4)(b). • Further quotation: "This Act shall not apply to the processing of personal data carried out by one or more persons solely for personal or household purposes" (Section 3) • Further quotation: "This Act shall apply, where the — (a) data controller or data processor is domiciled in, resident in, or operating in Nigeria ; (b) processing of personal data occurs within Nigeria ; or (c) the data controller or the data processor is not domiciled in, resident in, or operating in Nigeria, but is processing personal data of a data subject in Nigeria." (Section 2) • Further quotation: "A data controller or data processor shall ensure that personal data is" (Section 24) • Further quotation: "further processing for archiving purposes in the public interest" (Section 24)
OtherContinuousSource: Section 24 · Section 24 · page 16Suggested owner: Privacy Lead
Register controllers/processors of major importance with Commission
A controller or processor of major importance must register with the Commission under section 44(1), providing the detailed notification information under section 44(2). Imported research notes (check before approving): • Duty holders (any one of): data controller; data processor • Goes to: regulator (Nigeria Data Protection Commission) • Applies when: Act commencement for existing major-importance entities OR entity becomes of major importance • Timing in the source: "within six months after the commencement of the Act or on becoming a data controller or data processor of major importance" • Timing is flagged as ambiguous: The six-month phrase is tied to commencement, followed by “or on becoming” a major-importance entity; the Act does not explicitly say six months after becoming. Preserve both anchors and require legal review. • Exception: Commission may exempt classes of major-importance controllers or processors from section 44 registration when unnecessary or disproportionate. • Flagged by the research: The six-month phrase is tied to commencement, followed by “or on becoming” a major-importance entity; the Act does not explicitly say six months after becoming. Preserve both anchors and require legal review. • Further quotation: "This Act shall not apply to the processing of personal data carried out by one or more persons solely for personal or household purposes" (Section 3) • Further quotation: "This Act shall apply, where the — (a) data controller or data processor is domiciled in, resident in, or operating in Nigeria ; (b) processing of personal data occurs within Nigeria ; or (c) the data controller or the data processor is not domiciled in, resident in, or operating in Nigeria, but is processing personal data of a data subject in Nigeria." (Section 2) • Further quotation: "The Commission may exempt a class of data controllers or data processors of major importance" (Section 44)
RegistrationEvent-basedwithin six months after the commencement of the Act or on becoming a data controller or data processor of major importance — exact deadline not calculatedSource: Section 44 · Section 44 · page 29Suggested owner: Data Protection Officer
Provide phased breach information without undue delay
Where complete breach notification information cannot be supplied at the same time, the controller or processor may submit information in phases, but any phased supply must be without undue delay. Imported research notes (check before approving): • Duty holders (any one of): data controller; data processor • Applies when: Not all information required under section 40 can be provided at the same time • Timing in the source: "without undue delay" • Timing is flagged as ambiguous: Section 40(9) is an option to phase, with the qualitative “without undue delay” standard; its application to different notification streams depends on the underlying notices. • Flagged by the research: Section 40(9) is an option to phase, with the qualitative “without undue delay” standard; its application to different notification streams depends on the underlying notices. • Further quotation: "This Act shall not apply to the processing of personal data carried out by one or more persons solely for personal or household purposes" (Section 3) • Further quotation: "This Act shall apply, where the — (a) data controller or data processor is domiciled in, resident in, or operating in Nigeria ; (b) processing of personal data occurs within Nigeria ; or (c) the data controller or the data processor is not domiciled in, resident in, or operating in Nigeria, but is processing personal data of a data subject in Nigeria." (Section 2)
NotificationEvent-basedwithout undue delay — exact deadline not calculatedSource: Section 40 · Section 40 · page 27Suggested owner: Incident Response Lead
Sources & versions
Official sources
- Nigeria Data Protection Act, 2023
Official document · Federal Government Printer, Lagos, Nigeria · Jul 1, 2023 · Primary source
Version and updates
- Version
- As enacted 12 June 2023
- Published
- Oct 23, 2026
- Last reviewed
- Oct 23, 2026
Original Act as printed in the Federal Republic of Nigeria Official Gazette No. 119 of 1 July 2023.
Remindash provides this information to help organizations identify and track potential obligations. Applicability can depend on your organization's circumstances. Review official sources and obtain professional advice where appropriate.