NigeriaNigeria Data Protection Act, 2023, cross-border data transfer
In force since .
A cross border transfer rule binding public and private bodies.
- Obligation class
- Transfer
- Audit expectation
- none
What it requires
- Before transferring personal data outside Nigeria, rely on an adequacy decision by the Commission, a Commission-approved cross-border data transfer instrument, or another lawful basis such as consent or a compelling legal or fiduciary duty.
- Obtain the data subject's consent before transferring their personal data to a country for which the Commission has made no adequacy decision.
- Where you rely on an approved instrument rather than an adequacy decision, use one of the four the Commission recognises: a code of conduct, a certification, binding corporate rules, or standard contractual clauses.
- File the cross-border transfer instrument the Commission approved for you as part of your evidence of compliance.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Section 41(2) of the Act requires a controller or processor to record the basis on which it transfers personal data to another country and the adequacy of protection under section 42. The clause names no field of the record from the listed values, sets no retention period and names no one entitled to it. Section 41(3) lets the Commission make regulations requiring notice of the transfer measures, which is a power to require notification and is not a check of the record. The row cites no territorial clause, so no hook is read.
- Kind
- Explicit
- As of
- Provision
- Nigeria Data Protection Act, 2023, section 41(2)
- Trigger
- personal_data_processing
What this law does
Article 45 states that Part VIII of the Act provides for cross-border data transfer and, by section 63, is the overarching governing provision for every transfer of personal data out of Nigeria; pending any further regulatory instrument, the explanatory note in Schedule 5 is used to evaluate countries for adequacy and for the other grounds the Act recognises, and the Commission is to weigh the enforcement of fundamental rights and the decisions of courts advancing fundamental freedoms in a jurisdiction it considers.
Schedule 5 lists the grounds for transfer as an adequacy decision by the Commission, a Cross-Border Data Transfer Instrument the Commission approves, and other lawful bases, and sets out what the Commission weighs in adjudging a country adequate under section 42(2) of the Act: enforceable data subject rights with administrative or judicial redress and the rule of law, any instrument between the Commission and a competent authority in the recipient jurisdiction, the terms on which a public authority there reaches personal data, the existence of an effective data protection law that is in force and not subject to an overriding law, and a functioning independent supervisory authority with adequate enforcement powers.
The instruments the Commission may approve in the absence of an adequacy decision are codes of conduct, certifications, binding corporate rules and standard contractual clauses. Consent is separately required before personal data may be transferred to a country for which the Commission has made no adequacy decision.
The General Application and Implementation Directive 2025, which carries the text quoted here, is made under section 37 of the 1999 Constitution and sections 1(a), 6(c), 61 and 62 of the Nigeria Data Protection Act 2023, an Act in force since .
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .