NigeriaNigeria Data Protection Act, 2023 and GAID 2025, automated decisions
GAID 2025, art. 43(2)(a), under the Nigeria Data Protection Act, 2023 (automated decisions)
In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights
- Audit expectation
- none
What it requires
- Give a data subject the right not to be subject to a decision based solely on automated processes or algorithms.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 3.5Processes for human oversight are defined, assessed, and documented in accordance with organizational policies from the GOVERN function.
- NIST Privacy Framework
- CT.DM-P10Stakeholder privacy preferences are included in algorithmic design objectives and outputs are evaluated against these preferences.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What record it asks for
Logging duty
Article 43(2)(a) names, among the parameters a deployer of an emerging technology is to take into account, the right of a data subject not to be subject to a decision based solely on automated processes or algorithms. The sub-article states no duty to create, keep or produce a log or record. The duty to document the parameters and file them with the Commission is in Article 43(3), which this row does not cite and which is read on the row that cites Article 43 as a whole.
- Kind
- None
- As of
What this law does
Article 43 of the GAID requires a data controller or processor that deploys or intends to deploy Emerging Technologies, such as artificial intelligence, the Internet of Things or blockchain, to take the provisions of the Act into account when setting the technical and organisational parameters for that processing.
Those parameters must take into account a data subject's right not to be subject to a decision solely based on automated processes or algorithms, alongside the right to be forgotten, safeguards for sensitive and child data, cross-border transfer rules, and privacy by design. The parameters must be documented and filed with the Commission.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions.
Back to the example · Lint your app
Page updated .