Provide phased breach information without undue delay
Under Nigeria Data Protection Act, 2023
Overview
Where complete breach notification information cannot be supplied at the same time, the controller or processor may submit information in phases, but any phased supply must be without undue delay. Imported research notes (check before approving): • Duty holders (any one of): data controller; data processor • Applies when: Not all information required under section 40 can be provided at the same time • Timing in the source: "without undue delay" • Timing is flagged as ambiguous: Section 40(9) is an option to phase, with the qualitative “without undue delay” standard; its application to different notification streams depends on the underlying notices. • Flagged by the research: Section 40(9) is an option to phase, with the qualitative “without undue delay” standard; its application to different notification streams depends on the underlying notices. • Further quotation: "This Act shall not apply to the processing of personal data carried out by one or more persons solely for personal or household purposes" (Section 3) • Further quotation: "This Act shall apply, where the — (a) data controller or data processor is domiciled in, resident in, or operating in Nigeria ; (b) processing of personal data occurs within Nigeria ; or (c) the data controller or the data processor is not domiciled in, resident in, or operating in Nigeria, but is processing personal data of a data subject in Nigeria." (Section 2)
Important
This requirement was extracted from the source document. Applicability depends on your organization's circumstances. Review the official source and obtain professional advice where appropriate.
Key information
- Jurisdiction
- Nigeria
- Obligation type
- Notification
- Frequency
- Event-based
- Suggested owner
- Incident Response Lead
- Suggested priority
- High
- Policy categories
- Data Protection, Cybersecurity, Privacy
- Source
- Section 40, Section 40, page 27
- Suggested reminders
- 3 days before
- Policy last reviewed
- Oct 23, 2026
Details
Who this may apply to
Controllers and/or processors to whom the Act applies under section 2, subject to section 3 exemptions and any stated conditions. Condition (review): Controller or processor with the statutory duty in this record. Logic to review: Section 3(1) excludes solely personal/household processing unless that processing violates the data subject’s fundamental right to privacy. Logic to review: Section 2(2) gives three OR alternatives: controller/processor domicile, residence or operations in Nigeria; processing in Nigeria; or a foreign controller/processor processing personal data of a data subject in Nigeria. The rule engine must not replace this with an inaccurate AND requirement.
When this applies
Event-based · without undue delay — exact deadline not calculated
From the source
“the information may be provided in phases without undue delay.”
Section 40, Section 40, page 27
Other obligations in this policy
Explore other identified requirements from the same source policy.
Remindash provides this information to help organizations identify and track potential obligations. Applicability can depend on your organization's circumstances. Review official sources and obtain professional advice where appropriate.