NigeriaNigeria Data Protection Act, 2023, complaints, enforcement and redress
In force since .
An enforcement supervision rule binding public and private bodies.
- Enforcement body
- Nigeria Data Protection Commission (NDPC)
- Obligation class
- Governance, Reporting
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Expect a data subject to be able to complain to the Commission through its electronic platform or by any other reasonable means, and to have that complaint acknowledged within seven days and preliminarily evaluated.
- Attend a Pre-Action Conference as often as the Commission calls one in respect of a complaint or an investigation under section 46(3) of the Act.NIST Privacy FrameworkGV.PO-P5
- Keep concrete evidence of compliance with each provision you may be complained about: registration, annual Compliance Audit Returns, a filed impact assessment and an approved cross-border transfer instrument show good faith but do not answer a complaint about anything else.NIST Privacy FrameworkGV.MT-P3
- Expect a data subject to be able to seek redress in court for a violation of their data privacy rights, alongside the complaint route to the Commission.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Who may demand the log
Regulator
Logging duty
Article 48(2) says that registration, filing of Compliance Audit Returns, a filed impact assessment and an approved transfer instrument show prima facie good faith but do not replace the need to provide concrete evidence in defence of a complaint about any other provision. Evidence of that kind cannot be produced without records the controller has kept. Article 39(7) lets the Commission's notice of investigation require the respondent to supply its processor list, processing agreements, impact assessments and evidence of compliance. Neither clause names a log field or a retention period. Section 46(4) and (5) of the Act let the Commission order the production of any record relevant to an investigation. The row cites no territorial clause, so no hook is read.
- Kind
- Implicit
- As of
- Provision
- GAID 2025, Article 48(2), with Article 39(7)
- Trigger
- personal_data_processing
What this law does
Article 39 makes the right to lodge a complaint with the Nigeria Data Protection Commission a threshold right of redress under section 37 of the 1999 Constitution and section 46 of the Act, requires the Commission to run an electronic platform for complaints and to acknowledge one within seven days while continuing to accept complaints by any reasonable means, and requires it to carry out a preliminary evaluation of each complaint; a Pre-Action Conference may be held as often as a complaint or an investigation under section 46(3) needs.
Article 47 confirms that a data subject may seek redress for a violation of their data privacy rights in court, and treats proximity and access to courts as part of what national adequacy means.
Article 48 governs how the Commission weighs evidence of compliance: registration, annual Compliance Audit Returns, a filed impact assessment and an approved cross-border transfer instrument show accountability and prima facie good faith, but do not replace concrete evidence in defence of a complaint about any other provision, and the Commission treats accountability as partial fulfilment of the cooperation section 48(6)(f) of the Act requires.
Article 49 makes the safeguarding of a data subject's constitutional privacy right the overriding consideration in judging whether an obligation was met in time. The General Application and Implementation Directive 2025, which carries the text quoted here, is made under section 37 of the 1999 Constitution and sections 1(a), 6(c), 61 and 62 of the Nigeria Data Protection Act 2023, an Act in force since .
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .