Specify purposes and limit incompatible further processing
Under Nigeria Data Protection Act, 2023
Overview
Controllers and processors must collect personal data for specified, explicit and legitimate purposes and not further process it incompatibly; assess compatibility using the considerations in section 24(4), noting the research, statistical and public-interest archiving provision. Imported research notes (check before approving): • Duty holders (any one of): data controller; data processor • Timing in the source: "collected for specified, explicit, and legitimate purposes, and not to" • Exception: Further processing for archiving in the public interest, scientific or historical research or statistical purposes is not considered incompatible under section 24(4)(b). • Further quotation: "This Act shall not apply to the processing of personal data carried out by one or more persons solely for personal or household purposes" (Section 3) • Further quotation: "This Act shall apply, where the — (a) data controller or data processor is domiciled in, resident in, or operating in Nigeria ; (b) processing of personal data occurs within Nigeria ; or (c) the data controller or the data processor is not domiciled in, resident in, or operating in Nigeria, but is processing personal data of a data subject in Nigeria." (Section 2) • Further quotation: "A data controller or data processor shall ensure that personal data is" (Section 24) • Further quotation: "further processing for archiving purposes in the public interest" (Section 24)
Important
This requirement was extracted from the source document. Applicability depends on your organization's circumstances. Review the official source and obtain professional advice where appropriate.
Key information
- Jurisdiction
- Nigeria
- Obligation type
- Other
- Frequency
- Continuous
- Suggested owner
- Privacy Lead
- Policy categories
- Data Protection, Cybersecurity, Privacy
- Source
- Section 24, Section 24, page 16
- Policy last reviewed
- Oct 23, 2026
Details
Who this may apply to
Controllers and/or processors to whom the Act applies under section 2, subject to section 3 exemptions and any stated conditions. Condition (review): Controller or processor with the statutory duty in this record. Logic to review: Section 3(1) excludes solely personal/household processing unless that processing violates the data subject’s fundamental right to privacy. Logic to review: Section 2(2) gives three OR alternatives: controller/processor domicile, residence or operations in Nigeria; processing in Nigeria; or a foreign controller/processor processing personal data of a data subject in Nigeria. The rule engine must not replace this with an inaccurate AND requirement.
When this applies
Continuous
From the source
“collected for specified, explicit, and legitimate purposes, and not to be further processed in a way incompatible with these purposes ;”
Section 24, Section 24, page 16
Other obligations in this policy
Explore other identified requirements from the same source policy.
Remindash provides this information to help organizations identify and track potential obligations. Applicability can depend on your organization's circumstances. Review official sources and obtain professional advice where appropriate.