Overview
Introduction In today's data-driven world, personal data has become a vital asset driving access to the essential needs of our daily lives. As organisations and several businesses increasingly collect and process vast amounts of personal data to carry out their operations, concerns over privacy and data misuse have intensified, thereby highlighting the urgent need for data protection legislation. In Nigeria, this led to the enactment of the Nigerian Data Protection Act 2023 (“NDP Act” or “the Act”), This establishes a statutory framework designed to ensure data privacy and regulate data governance. The Act also affirms the fundamental rights of data subjects.
Central to the Nigerian Data Protection Act 2023 is the establishment of the Nigerian Data Protection Commission (“NDPC” or “The Commission”), vested with broad regulatory powers to ensure compliance with the NDP Act. To enforce the rights of data subjects, on March 20, 2025, the NDPC issued the General Application and Implementation Directive (“GAID”), which outlines a detailed procedure for enforcing the rights of data subjects against data controllers and 3 data processors. In light of the above, this article critically examines the concept of a data subject's rights and the enforcement frameworks established by the NDP Act and the GAID. It further evaluates the enforceability of data subjects' rights under the NDP Act and the GAID, as well as the challenges that arise from this.
