Processes personal data, in Nigeria

National Health Act, 2014 (Act No. 8 of 2014), health records and confidentiality (ss. 25-29) · Read the law's page

• Treat all information concerning a user of health services, including information relating to the user's health status, treatment or stay in a health establishment, as confidential (section 26(1)).
• Do not disclose that information unless the user consents in writing, a court order or any law requires the disclosure, a parent or guardian asks in the case of a minor, a guardian or representative asks in the case of a person otherwise unable to grant consent, or non-disclosure represents a serious threat to public health (section 26(2)).
• Where you are the person in charge of a health establishment, ensure that a health record containing the prescribed information is created and available at the establishment for every user of health services, subject to applicable archiving legislation (section 25).
• Where you are the person in charge of a health establishment in possession of a user's health records, set up control measures to prevent unauthorised access to those records and to the storage facility or system in which they are kept (section 29(1)).
• Where you are a health care provider, examine a user's health records for treatment with the user's authorisation, and for study, teaching or research with the authorisation of the user, the head of the health establishment concerned and the relevant health research ethics committee, unless the study, teaching or research obtains no information as to the user's identity (section 28).
• Do not falsify a record, create, change or destroy a record without authority, provide false information with the intent that it be included in a record, or copy any part of a record without authority (section 29(2)).

Central Bank of Nigeria, Revised Regulatory Framework for Bank Verification Number (BVN) Operations and Watch-list for the Nigerian Banking Industry (October 2021) · Read the law's page

• Capture BVN data properly, including data captured by your agents, and validate it before you link it to a customer's account or wallet, except Tier 1; link every operated account or wallet, except Tier 1, to the signatories' BVNs within 24 hours of NIBSS making the BVN available, and link the BVNs of all signatories, Directors and beneficial owners to non-individual accounts or wallets (clause 1.5.3(i), (ii) and (iv)).
• Let no new account or wallet, except Tier 1, operate without a BVN, except for inflows, and close any account or wallet, except Tier 1, that has no BVN within 30 days (clause 1.6(v)).
• Require a BVN or a NIN for each individual Tier 1 account or wallet, and a BVN and a NIN for each individual Tier 2 and Tier 3 account or wallet, as the Central Bank's December 2023 circular directs (Central Bank BVN page).
• Report the BVNs of individuals in breach to NIBSS for update on the Watch-list within 1 business day of breach, and report the BVNs of confirmed deceased customers to NIBSS for designation as "DECEASED" within 24 hours of confirmation (clause 1.5.3(vi) and (vii)).
• Investigate an alleged breach within one month, place the customer's account on Post-No-Debit once a breach is established, notify the customer through verifiable means within five business days, and give the customer three business days to present documentary evidence before a decision to watch-list the BVN (clauses 2.1 and 2.2).
• Integrate your banking application with the Watch-list for online identification and verification of watch-listed individuals as transactions occur, and enforce the sanctions in the Framework on customers' accounts or wallets, except Tier 1 (clause 1.5.3(xiii) and (xiv)).
• Use the BVN API only for account or wallet opening, maintenance and validation, and do not use a BVN to sanction an individual for a non-financial offence or for identification outside the banking system (clauses 1.5.3(xvi) and 1.9).
• Allow access to the BVN database only as clause 1.7 provides: other financial institutions, excluding payment service providers, and payment service providers through NIBSS need the customer's consent, and foreign entities are not allowed access (clause 1.7).
• Store BVN data within Nigeria and do not route it across borders without the consent of the Central Bank, treat BVN information as confidential, put in place secure hardware, software and encryption of messages transmitted through a secured network, and comply with the Nigeria Data Protection Regulation or any Central Bank regulation on data protection (clause 1.11).

Nigeria Data Protection Act, 2023 (No. 37 of 2023), general duties (ss. 1-3, 24-29, 32-33, 39 and 63-65; GAID 2025, arts. 1-17, 19-32, 34-35 and 41-42) · Read the law's page

• Register with the Commission as a data controller or data processor of major importance where the Commission so determines, conduct a compliance audit within fifteen months of commencing business and annually thereafter, and file Compliance Audit Returns by 31 March each year in the Ultra-High and Extra-High Level categories.
• Tell the Commission of any significant change to the information in your most recent registration submission within sixty days of the change.
• Designate a Data Protection Officer as section 32 of the Act mandates, give the officer the position the Directive prescribes, and have the officer prepare semi-annual data protection reports.
• Process personal data on one of the lawful bases section 25 recognises, and hold to the section 24 principles of fairness, lawfulness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, confidentiality, integrity and availability.
• Take consent for cookies and other tracking tools freely, informed and specific, display a conspicuous cookie banner at the first part of the page, and let a data subject reject every cookie other than the necessary ones that carry security, network stability and accessibility.
• Carry out a Data Privacy Impact Assessment where required, including where deploying software to process sensitive personal data, and file it with the Commission.
• Before deploying data processing software that tracks a data subject or opens a communication link with one, carry out an impact assessment, design it for privacy by design and by default, put a data privacy policy inside the software, and give a prospective user a privacy statement before installation.
• Put a Data Processing Agreement in place with any data processor you engage, setting out the obligations of both parties under section 29 of the Act.
• Follow schedules for monitoring, evaluating and maintaining the data security system, and for organisation-wide internal sensitisation and training on data privacy.

Nigeria Data Protection Act, 2023, complaints and enforcement (ss. 46 and 48; GAID 2025, arts. 39, 47 and 48) · Read the law's page

• Expect a data subject to be able to complain to the Commission through its electronic platform or by any other reasonable means, and to have that complaint acknowledged within seven days and preliminarily evaluated.
• Attend a Pre-Action Conference as often as the Commission calls one in respect of a complaint or an investigation under section 46(3) of the Act.
• Keep concrete evidence of compliance with each provision you may be complained about: registration, annual Compliance Audit Returns, a filed impact assessment and an approved cross-border transfer instrument show good faith but do not answer a complaint about anything else.
• Expect a data subject to be able to seek redress in court for a violation of their data privacy rights, alongside the complaint route to the Commission.

Nigeria Data Protection Act, 2023, cross-border data transfer (Part VIII; GAID 2025, art. 45 and Schedule 5) · Read the law's page

• Before transferring personal data outside Nigeria, rely on an adequacy decision by the Commission, a Commission-approved cross-border data transfer instrument, or another lawful basis such as consent or a compelling legal or fiduciary duty.
• Obtain the data subject's consent before transferring their personal data to a country for which the Commission has made no adequacy decision.
• Where you rely on an approved instrument rather than an adequacy decision, use one of the four the Commission recognises: a code of conduct, a certification, binding corporate rules, or standard contractual clauses.
• File the cross-border transfer instrument the Commission approved for you as part of your evidence of compliance.

Nigeria Data Protection Act, 2023, data breach notification (s. 40; GAID 2025, art. 33) · Read the law's page

• Notify the Commission of a personal data breach likely to result in a risk to individuals' rights and freedoms within 72 hours of becoming aware of it, describing the nature of the breach and, where feasible, the categories and approximate numbers of data subjects and records concerned.
• Notify affected data subjects immediately after becoming aware of a breach likely to result in a high risk to their rights and freedoms.
• Give the Commission and every other relevant authority immediate information about a breach, whatever time you otherwise have, where that may help contain an imminent breach on a national scale, where containment may be needed nationally, sectorally or individually, or where the breach may affect the general public.
• Put in the notification the circumstances of the loss or unauthorised access or disclosure, the date or time period it occurred over, the personal information involved, an assessment of the risk of harm, an estimate of the number of individuals at real risk of significant harm, the steps you took to reduce that harm and to notify individuals, and the name and contact details of someone who can answer for you.

Nigeria Data Protection Act, 2023, rights of a data subject (ss. 27 and 46; GAID 2025, arts. 27 and 36-40) · Read the law's page

• Give a data subject an effective opportunity to rectify their personal data on the platform you process it through, without requiring an affidavit or a newspaper publication where the correction aligns the data with their National Identification Number, and without charging them for an error that was not their fault.
• Give effect to the right to data portability where the data subject supplied the personal data on the basis of consent or where the processing is necessary to perform a contract, without prejudice to the rights of other data subjects whose data is in the same set.
• Erase personal data on request where it is no longer necessary for its original purpose, where consent was the lawful basis and has been withdrawn, where the data subject objects to processing founded on legitimate interest and no overriding ground exists, where it is processed for direct marketing and the data subject objects, where it was processed unlawfully, or where a legal ruling or obligation requires erasure.
• Carry a clause on the right to lodge a complaint with the Commission in every regulation, policy, framework or legal instrument of yours that pertains to processing personal data, and answer a Standard Notice to Address Grievance a data subject serves on you.
• Give a data subject the information section 27 of the Act requires in clear terms, taking their circumstances into account.

National Identity Management Commission (Establishment) Act, 2026 (Act No. 3 of 2026), ss. 24-27 · Read the law's page

• Do not access the data or information held in the National Identity Database for a registered person unless the registered person has given and not withdrawn consent to the disclosure, or the disclosure is necessary for compliance with a legal obligation you are subject to, for a task carried out in the public interest or in the exercise of official authority vested in you, for the prevention, detection, investigation, prosecution or punishment of an offence, or for the preparation or conduct of proceedings before a court (section 24(2)).
• Where you are provided with registered information in connection with a particular purpose, use it for that purpose only, unless the registered person consents to the other use, the other use is authorised or required by law, the other purpose is directly related to the purpose for which the information was collected, or the information is used in a form in which the registered person is not identified or for statistical or research purposes without being published in a form that can reasonably be expected to identify the person (section 24(6)).
• Where you use or disclose registered information, implement appropriate technical and organisational measures to ensure that the use or disclosure does not harm the rights and freedom of the relevant registered person (section 24(7)).
• State in each request for access to registered information the purpose for which it is required, the period of retention of the information, the recipient, and the security and confidential modalities for disposing of the information once it is no longer required (section 24(9)).
• Where you are an agent the Commission licenses to carry out authentication and verification on its behalf, store any registered information securely and perform only the services the Act and the Commission's directions provide for (section 25(1)).
• Where you facilitate, or provide the service for, a transaction listed in section 26(1), among them financial transactions, the opening of bank accounts, the purchase of insurance policies, registration for telecommunications services, consumer credit transactions and the payment of taxes, verify the identity of the parties involved in the transaction using the National Identity Number provided (section 26(4)).
• Do not, without lawful authorisation by the Commission, intentionally access or secure access to the National Identity Database, download, copy or extract data from it, reveal, share, use or display information contained within it, or use or tamper with its data to modify information relating to a registered person or to discover any information (section 27(1)).

Cybercrimes (Prohibition, Prevention, etc.) Act, 2015, section 21, Reporting of Cyber Threats, as amended by the Cybercrimes (Prohibition, Prevention, etc.) (Amendment) Act, 2024 · Read the law's page

• This binds any person or institution, whether public or private, that operates a computer system or a network in Nigeria; there is no sector or size gate.
• Immediately inform the National Computer Emergency Response Team (CERT) Coordination Center, through your sectoral CERT or sectoral Security Operations Centre, of any attack, intrusion, or other disruption liable to hinder the functioning of another computer system or network.
• Report the incident to the National CERT within 72 hours of its detection. Failing to do so is itself an offence, punishable by denial of internet services and a mandatory fine of N2,000,000 payable into the National Cyber Security Fund.

Guidelines for Nigerian Content Development in Information and Communication Technology (ICT), as amended, August 2019, paragraph 4 of sections 11.1 and 12.1 · Read the law's page

• If you are a telecommunication company, host all subscriber and consumer data within the country, in line with existing legislation (section 11.1, paragraph 4).
• If you are a networking service company, host all subscriber and consumer data within the country (section 12.1, paragraph 4).