Process data fairly, lawfully and transparently
Under Nigeria Data Protection Act, 2023
Overview
Controllers and processors must ensure all personal data is processed fairly, lawfully and transparently. Imported research notes (check before approving): • Duty holders (any one of): data controller; data processor • Timing in the source: "processed in a fair, lawful and transparent manner" • Further quotation: "This Act shall not apply to the processing of personal data carried out by one or more persons solely for personal or household purposes" (Section 3) • Further quotation: "This Act shall apply, where the — (a) data controller or data processor is domiciled in, resident in, or operating in Nigeria ; (b) processing of personal data occurs within Nigeria ; or (c) the data controller or the data processor is not domiciled in, resident in, or operating in Nigeria, but is processing personal data of a data subject in Nigeria." (Section 2) • Further quotation: "A data controller or data processor shall ensure that personal data is" (Section 24)
Important
This requirement was extracted from the source document. Applicability depends on your organization's circumstances. Review the official source and obtain professional advice where appropriate.
Key information
- Jurisdiction
- Nigeria
- Obligation type
- Other
- Frequency
- Continuous
- Suggested owner
- Privacy Lead
- Suggested priority
- Medium
- Policy categories
- Data Protection, Cybersecurity, Privacy
- Source
- Section 24, Section 24, page 16
- Policy last reviewed
- Oct 23, 2026
Details
Who this may apply to
Controllers and/or processors to whom the Act applies under section 2, subject to section 3 exemptions and any stated conditions. Condition (review): Controller or processor with the statutory duty in this record. Logic to review: Section 3(1) excludes solely personal/household processing unless that processing violates the data subject’s fundamental right to privacy. Logic to review: Section 2(2) gives three OR alternatives: controller/processor domicile, residence or operations in Nigeria; processing in Nigeria; or a foreign controller/processor processing personal data of a data subject in Nigeria. The rule engine must not replace this with an inaccurate AND requirement.
When this applies
Continuous
From the source
“processed in a fair, lawful and transparent manner ;”
Section 24, Section 24, page 16
Other obligations in this policy
Explore other identified requirements from the same source policy.
Remindash provides this information to help organizations identify and track potential obligations. Applicability can depend on your organization's circumstances. Review official sources and obtain professional advice where appropriate.