← Global Privacy Laws Research Library
Nigeria Data Protection Act, 2023
Nigeria Data Protection Act 2023: NDPA
Prepared by Shubhank Suman · Last reviewed
CURRENT
- Legal character
- Federal statute
- Region
- Africa
- Signed
- 12 June 2023
What it covers
The NDPA establishes:
- lawful processing
- data-subject rights
- controllers/processors
- DPO/accountability structures
- DPIAs
- security
- data breaches
- automated decisionmaking
- data portability
- transfers
- enforcement
- sanctions.
AI, privacy and cybersecurity relevance
- AI: Very High
- Privacy: Very High
- Cyber: Very High
AI
VERY HIGH
Section 37 makes Nigeria particularly important for:
- automated decisionmaking
- profiling
- AI scoring
- AI recruitment
- financial AI
- insurance/health AI.
The NDPC's 2025 GAID further elaborates high-risk processing and DPIA requirements, including automated decisionmaking and profiling. (files.lbr.cloud)
Cybersecurity
VERY HIGH
Security and breach notification are statutory obligations, with the 72-hour Commission notification mechanism.
Applicability
Controllers/processors subject to the NDPA's territorial and processing conditions.
Current validity
CURRENT.
The NDPC continues to list the NDPA as its principal regulatory source. (Nigeria Data Protection Commission)
Read first
Sections 24–30 → Sections 34–38 → Section 37 → Sections 39–40 → Sections 41–43 → 2025 GAID.
Provisions / sections covered
Section 24
Data-processing principles.
Sections 28–30
DPIAs and responsibilities associated with processing.
Sections 34–38
Data-subject rights.
The NDPC itself currently operates a DSAR mechanism under Sections 34–38 and states that requests ordinarily receive a response within 30 days. (NDPC Forms)
Section 37: Automated decisionmaking
The Act gives data subjects a right not to be subjected to decisions based solely on automated processing, including profiling, producing legal or similarly significant effects.
The statutory exceptions include:
- contract
- written law with appropriate safeguards
- consent.
Controllers must implement safeguards including:
- human intervention
- ability to express a viewpoint
- ability to contest the decision.
(LawGlobal Hub)
Section 39: Security
Provides the data-security framework.
Section 40: Breach
A controller must notify the Commission within 72 hours of becoming aware of a breach likely to create risk to individuals' rights/freedoms, subject to the statutory conditions.
High-risk breaches trigger communication to affected data subjects. (LawCare Nigeria)
Sections 41–43
International transfers and related controls.
Subject-matter tags
- Lawful basis
- Consent
- Sensitive data
- Data subject rights
- Data portability
- Profiling
- Automated decision-making
- Impact assessment
- Data breach
- Cross-border transfers
- Data protection officer
- Controller and processor
- Enforcement and penalties
- Accountability
Subject-matter tags describe what the indexed text discusses. They are not legal conclusions.
Document page in the Knowledge Base - full text or PDF where it is available for this record.
This library locates primary and official sources. It does not interpret the law and it is not legal advice.