Law: Nigerian Data Protection Act, 2023 (the Act)

Regulator: the Nigeria Data Protection Commission (NDPC)

Summary: On June 14, 2023, the President of Nigeria signed the Act which provides a legal framework for the protection of personal information and establishes the NDPC. In particular, the Act in line with international standards establishes principles for the processing of personal data, outlining specific requirements for the processing of sensitive and children's data.

In addition, the Act creates requirements for data controller including the conducting of Data Protection Impact Assessments, the appointment of a data protection officer, breach notification, and data security requirements. Moreover, the Act imposes restrictions on cross border transfers, while adopting the concept of adequate protection. Furthermore, data subjects are provided with rights including right to object, withdraw consent, data portability, and the right not to be subject to a decision based solely on automated processing of personal data.