Processes biometric data, in Nigeria

Access to Registered Information in the National Identity Database Regulations, 2017 (S.I. No. 16 of 2017) · Read the law's page

• Where you are a person other than a security, Government or licensed private agency, obtain an application made by or with the authority of the registered individual, or the individual's consent given by submitting the National Identification Number or biometrics, before you receive that individual's registered information, and do not seek fingerprint or other biometric information through such an application (regulation 4(1) and (2)).
• Where you are a private agency verifying or authenticating a registered individual's identity against the National Identity Database, hold the licence the Commission grants, obtain the registered individual's consent and pay the applicable fees (regulation 7(1) and (2)).
• Where you are a Government agency, make a prior written request to the Commission from an official not below the rank of a Permanent Secretary or Director-General, and comply with the procedures, processes and guidelines the Commission prescribes (regulation 6(2)).for a public body
• Use devices that conform to the specifications and standards in the Commission's guidelines when obtaining registered information (regulation 8(2)).
• Do not use or disclose registered information obtained by the grant of access without authority, and do not access data or information contained in the National Identity Database without authority (regulation 9(2)(d) and (h)).

Cybercrimes (Prohibition, Prevention, etc.) Act, 2015, section 21, Reporting of Cyber Threats, as amended by the Cybercrimes (Prohibition, Prevention, etc.) (Amendment) Act, 2024 · Read the law's page

• This binds any person or institution, whether public or private, that operates a computer system or a network in Nigeria; there is no sector or size gate.
• Immediately inform the National Computer Emergency Response Team (CERT) Coordination Center, through your sectoral CERT or sectoral Security Operations Centre, of any attack, intrusion, or other disruption liable to hinder the functioning of another computer system or network.
• Report the incident to the National CERT within 72 hours of its detection. Failing to do so is itself an offence, punishable by denial of internet services and a mandatory fine of N2,000,000 payable into the National Cyber Security Fund.