Overview
1. What type of data is covered under the NDPA?
Personal data and sensitive personal data. These include any information that identifies or can be used to identify an individual, such as names, addresses, phone numbers, emails, and biometric data. This may also include data that is pseudonymized as long as it can be used to identify a person. 2. What types of rights are covered under the NDPA and are they absolute?
Sections 34, 35, and 36 of the NDPA provides that individuals in Nigeria have certain rights over their personal data, including the right to access, correct, delete, or object to the processing of their information. The rights are not absolute. 3. Are all organisations required to comply with data protection laws?
Yes, regardless of size and location, all organisations with operations in Nigeria and dealing with the data of subjects based in Nigeria are required to comply with the Nigerian Data Protection Act, 2023. Therefore, even foreign companies that process or intend to process the personal data of Nigerians are bound by the law. 4. What data protection laws are companies required to comply with?
The primary data protection laws are the Nigerian Data Protection Act, 2023; Nigerian Data Protection Implementation Framework 2019, and the Cybercrime Act. The primary regulator is the Nigerian Data Protection Commission (“the Commission”). Although, certain sector specific regulators such as the Nigerian Communications Commission may also regulate the privacy practices of those organisations operating within the sector. 5. What are the penalties for non-compliance with data protection laws in Nigeria?
The penalties for non-compliance include fines of up to ₦10 million or 2% of an organization’s annual gross turnover for the preceding financial year, (whichever is higher) for data breaches, legal actions which include suspension or restriction of data processing activities, and potential lawsuits from affected individuals. 6. Do the laws apply to cross-border transfer of data and what does that mean?
Yes, the laws apply to cross-border transfer of data. What this means is that in order to transfer data outside of Nigeria, a company must confirm that the recipient country falls within the whitelist of countries i.e., Nigeria has deemed those countries to have sufficient data protection laws. If the recipient country is not on the whitelist, the transfer of personal data requires the consent of the data subject or must meet other conditions specified under Section 43 of the NDPA. 7. Are there any registration requirements obligations for data controllers and data processors?
Yes, there are registration requirements for the data controllers and data processors deemed to be of major importance. A data controller or data processor of major importance is defined based on a fiduciary relationship, nature of services, number of data subjects and the impact on the Nigerian economy. Should a company fall within the categories of Extra, Ultra and Ordinary as defined by the Commission’s guideline on DCDPMI, they would be required to register with the Commission at a stipulated fee.[1] 8. Are there any reporting requirements for data controllers or data processors?
Yes, there are reporting requirements. Data controllers and processors of major importance are required to file a data protection audit reports to the Commission by March 15 of each year. This function is carried out by a company’s data protection compliance organisation, such as Kenna Partners. The data controllers and processors are also required to report data breaches to the Commission. 9. Must a Data Protection Officer be from within an organisation?
No, the data protection officer may be an external party and must be based in Nigeria. 10. Is a Data Protection Compliance Organisation required and what type of service does Data Protection Compliance Organisation provide?
Yes, a Data Protection Compliance Organisation is required for companies that wish to be in full compliance with the NDPA. The services provided include: training on data protection best practices, conducting data protection audits, conducting data protection impact assessments, filing of audit report, advisory on data protection compliance. [1] We note that certain provisions of this guideline have been determined void by a Court of law.
