The Nigeria Data Protection Act 2023 (the “Act”) is the first major federal legislative instrument for the processing and protection of personal data in Nigeria and supersedes any other law or enactment that relates directly or indirectly to the processing of personal data. For a better understanding of the Act, we have prepared an overview of some of the salient provisions in the Act:

Introduction

The draft Data Protection Bill was introduced by the Nigeria Data Protection Bureau (“NDPB”) on the 4th of October 2022 and was approved by the Federal Executive Council in February 2023. The bill was assented into law and formally became the Nigeria Data Protection Act 2023 on Tuesday 12th of June 2023, by President Bola Ahmed Tinubu.

Scope

The Act applies to processing of personal data within Nigeria or the processing of the personal data of a data subject that is in Nigeria by both foreign and local data controllers and processors. Irrespective of whether the processing is by automated means.

The Act does not apply to processing of personal data that is done solely for personal and or household purposes, subject to the fundamental right to privacy of a data subject^[1]. It further includes a number of limited exceptions.

Key Highlights

Introduction of New Categorization of Data Controller/Processor and Duty to Register as a Data controller and Processor:

The Act introduces a new classification of data controllers and processors i.e., “Data Controllers and Data Processors of major importance” (“DCPMI”) with compulsory registration obligations^[2] with the Commission where they meet the threshold for such registration^[3]^.