The local regime.
WHAT THE CURRENT PRIMARY LAW IS
The Nigeria Data Protection Act, enacted in 2023.
WHAT IT ESTABLISHED
The Nigeria Data Protection Commission, as the regulator.
WHAT PRECEDED IT
The Nigeria Data Protection Regulation of 2019, issued under the information technology agency.
WHY THAT HISTORY MATTERS
Obligations and guidance from that period informed current practice, and references to it persist.
WHAT THE ACT BROADLY REQUIRES
A lawful basis for processing Transparency with data subjects Security measures Rights for individuals Accountability and record-keeping Notification of breaches Registration, for certain organisations A data protection officer, in defined circumstances
WHO IT APPLIES TO
Organisations processing personal data in Nigeria, and in defined circumstances those outside processing data of people in Nigeria.
WHAT THAT MEANS FOR A NIGERIAN BUSINESS
It almost certainly applies to you.
WHAT THE REGULATOR CAN DO
Investigate, order remedies, and impose sanctions.
WHY YOU SHOULD VERIFY DETAILS
Subsidiary regulations, thresholds and procedures are issued and updated over time.
WHERE TO CHECK
The Commission's own publications.
WHAT TO TREAT THIS ARTICLE AS
An orientation, not a substitute for current official guidance or legal advice.
