President Bola Tinubu of Nigeria has officially signed the Nigeria Data Protection Bill into law. The legislation, known as the Nigeria Data Protection Act of 2023, establishes a legal framework to protect personal information and regulate data protection practices within the country.
The bill was presented to the Senate and House of Representatives on April 4, 2023, through a letter from former President Muhammadu Buhari. With its transformation into an Act, the new law replaces the Nigeria Data Protection Bureau (NDPB), established by President Buhari in February 2022, and establishes the Nigeria Data Protection Commission. The Commission will be headed by a National Commissioner responsible for overseeing the regulation of personal information processing.
Among its key responsibilities, the Commission is tasked with promoting the development of personal data protection technologies in accordance with recognized international best practices and ensuring compliance with data protection obligations. Additionally, the Commission possesses the authority to register data controllers and data processors of significant importance, raise awareness regarding the obligations of data controllers and processors, and impose sanctions on those who violate the provisions of the Act.
Under the Nigeria Data Protection Act, the President will appoint a National Commissioner for the Commission, serving a renewable four-year term. The National Commissioner will be responsible for the day-to-day administration and execution of policies. Furthermore, a Governing Council will be established to formulate policy directions for the Commission, approve strategic and budgetary plans, and oversee other relevant matters.
The Act introduces several requirements for data controllers, who must provide specific information to data subjects (individuals whose data is being collected) prior to data collection. This information includes the identity and business address of the collector or processor, the lawful basis for data processing, recipients of the data, data retention period, and the right to file complaints with the Commission, among other details.
The Commission is granted powers to issue compliance and enforcement orders against data controllers or processors in cases of violation, with these orders being subject to judicial review within 30 days. Failure to comply with the Commission’s orders is now a criminal offense, punishable by fines and/or imprisonment. In case of a violation, data subjects also have the right to seek damages through civil proceedings.
The Nigeria Data Protection Act sets out fundamental principles for the processing of personal data, emphasizing fairness, lawfulness, transparency, and limited data collection for specific purposes. It prohibits data retention for longer than necessary. Notably, the burden of proof rests with the data controller to demonstrate that they have obtained the consent of the data subject, with silence or inactivity not implying consent. For children, who lack the capacity to consent, a parent or guardian can provide consent on their behalf. Data subjects have the right to withdraw consent, at which point the data controller must cease processing unless public interest or other legitimate grounds override the data subject’s rights and freedoms.
The Act guarantees data subjects’ rights to access information relating to the processing, storage, and other relevant details about their data from data controllers. Data controllers are also mandated to report data breaches to the Commission and inform affected data subjects if the breach poses a high risk to their rights and freedoms.
The enactment of the Nigerian Data Protection Act represents a significant stride towards safeguarding privacy rights, fostering trust, and promoting responsible data-driven innovation within the country.
