Sends faxes, in Nigeria

Nigeria Data Protection Act, 2023, rights of a data subject (ss. 27 and 46; GAID 2025, arts. 27 and 36-40) · Read the law's page

• Give a data subject an effective opportunity to rectify their personal data on the platform you process it through, without requiring an affidavit or a newspaper publication where the correction aligns the data with their National Identification Number, and without charging them for an error that was not their fault.
• Give effect to the right to data portability where the data subject supplied the personal data on the basis of consent or where the processing is necessary to perform a contract, without prejudice to the rights of other data subjects whose data is in the same set.
• Erase personal data on request where it is no longer necessary for its original purpose, where consent was the lawful basis and has been withdrawn, where the data subject objects to processing founded on legitimate interest and no overriding ground exists, where it is processed for direct marketing and the data subject objects, where it was processed unlawfully, or where a legal ruling or obligation requires erasure.
• Carry a clause on the right to lodge a complaint with the Commission in every regulation, policy, framework or legal instrument of yours that pertains to processing personal data, and answer a Standard Notice to Address Grievance a data subject serves on you.
• Give a data subject the information section 27 of the Act requires in clear terms, taking their circumstances into account.

Nigeria Data Protection Act, 2023, sensitive personal data and a child's data (GAID 2025, arts. 18 and 43) · Read the law's page

• Obtain a data subject's consent before processing sensitive personal data, and before processing the personal data of a child.
• Do not seek, give or accept consent in any circumstance that may propagate atrocities, hate, child rights violations or criminal acts.
• Where you deploy an emerging technology such as artificial intelligence, the Internet of Things or blockchain to process personal data, set technical and organisational parameters that take account of safeguards for sensitive personal data, safeguards for child rights and other vulnerable groups, the right against solely automated decisions, the right to be forgotten, cross-border data flows, and privacy by design and by default.
• Document those parameters and file them with the Commission as part of your Compliance Audit Returns, with an impact assessment that weighs disparate outcomes of the processing and the Data Subjects' Vulnerability Indexes in Schedule 6.
• State in your Compliance Audit Returns whether you rely on consent for any of the activities article 18 lists.

Cybercrimes (Prohibition, Prevention, etc.) Act, 2015, section 21, Reporting of Cyber Threats, as amended by the Cybercrimes (Prohibition, Prevention, etc.) (Amendment) Act, 2024 · Read the law's page

• This binds any person or institution, whether public or private, that operates a computer system or a network in Nigeria; there is no sector or size gate.
• Immediately inform the National Computer Emergency Response Team (CERT) Coordination Center, through your sectoral CERT or sectoral Security Operations Centre, of any attack, intrusion, or other disruption liable to hinder the functioning of another computer system or network.
• Report the incident to the National CERT within 72 hours of its detection. Failing to do so is itself an offence, punishable by denial of internet services and a mandatory fine of N2,000,000 payable into the National Cyber Security Fund.