NDPA: The Complete Guide
The Nigeria Data Protection Act 2023 is a landmark piece of legislation for Africa's largest economy and most populous nation. Signed into law in June 2023, the NDPA replaces the earlier Nigeria Data Protection Regulation (NDPR) of 2019 and establishes the Nigeria Data Protection Commission as an independent regulatory body with broad enforcement powers.
What the NDPA Covers
The NDPA establishes a framework for lawful data processing built on principles of fairness, lawfulness, purpose limitation, data minimization, accuracy, storage limitation, integrity, confidentiality, and accountability. Processing requires a lawful basis, including consent, contractual performance, legal obligation, vital interests, public interest, and legitimate interests.
Data subjects are granted comprehensive rights including the right to be informed, access their personal data, request rectification, request erasure, restrict processing, data portability, and object to processing. The Act also provides protections against automated decision-making and profiling that produce legal or significant effects.
Special personal data — including racial or ethnic origin, political opinions, religious beliefs, health, sexual life, genetic and biometric data, and criminal records — requires explicit consent or must meet specific conditions for processing.
Annual Audit Requirement
A distinctive feature of Nigeria's data protection framework is the mandatory annual data protection audit. Data controllers and processors designated as being of "major importance" by the NDPC must engage a licensed Data Protection Compliance Organization (DPCO) to conduct an annual audit and file the results with the Commission. This requirement creates a structured compliance verification mechanism not found in most other data protection laws.
Who Needs to Comply
The NDPA applies to all organizations that process the personal data of individuals in Nigeria, regardless of whether the organization is established in Nigeria. It also applies to organizations outside Nigeria that process personal data of Nigerian residents in connection with offering goods or services or monitoring behavior.
Enforcement and Penalties
The NDPC has the authority to investigate complaints, conduct audits, and impose penalties. Fines for violations can reach up to 2% of annual gross revenue or 10 million Naira, whichever is greater, for data controllers of major importance.
Practical Compliance Steps
- NDPC registration — Register with the Nigeria Data Protection Commission
- DPCO engagement — Engage a licensed Data Protection Compliance Organization for annual audits
- Lawful basis mapping — Document the legal basis for each processing activity
- Data subject rights — Implement mechanisms for exercising all data subject rights
- DPO appointment — Designate a Data Protection Officer as required
- Cross-border transfer assessment — Evaluate and implement safeguards for international data transfers