Nigeria Implements Data Protection Act, Boosting Privacy and Security

President Bola Ahmed Tinubu has signed the Nigeria Data Protection Bill, 2023 into law, providing the country with a concrete legal framework for the protection and processing of personal information.

The new Nigeria Data Protection Act, 2023 replaces the Nigeria Data Protection Regulation (NDPR) and establishes the Nigeria Data Protection Commission (NDPC) as the regulatory body.

Key provisions of the law include requirements for fair, lawful, and transparent processing of personal data with appropriate security measures to prevent unauthorized access, loss, or breach.

In the event of a data breach, data controllers or processors are obligated to notify the Commission promptly. The law also mandates impact assessments when processing personal data could infringe on individual rights and sets out criminal and financial sanctions for non-compliance.

The legislation has been well-received in the industry, with expectations that it will boost Nigeria’s data protection sector to 16.5 billion naira (about $21.6 million) and generate job opportunities within the data protection ecosystem.

The Association of Licensed Data Protection Compliance Organisations of Nigeria (ALDAPCON) praised the move and called for increased collaboration between industry players and the regulator.

However, legal experts have expressed concerns about certain provisions that require further clarification, such as defining the volume of data processed by data processors and establishing clear timelines for responding to data subject requests.

The intentions of the law are generally seen as positive, but there is a need for clarity on these specific issues, according to legal experts from Lagos-based law firm Lexworth Legal Partners.

Despite these concerns, the new law represents a significant step forward in protecting personal data, enhancing data privacy, and promoting data sovereignty in Nigeria. It aims to foster a culture where the protection of personal data is a cherished principle and an inviolable obligation.

The NDPC believes that the new legislation will bring clarity to the roles of data processors and controllers, further improving the overall health of the industry and contributing to Nigeria’s GDP.