NigeriaNigeria Data Protection Act, 2023, data breach notification
Nigeria Data Protection Act, 2023, data breach notification (s. 40; GAID 2025, art. 33)
In force since .
A breach notification rule binding public and private bodies.
- Obligation class
- Breach notice, Reporting
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Notify the Commission of a personal data breach likely to result in a risk to individuals' rights and freedoms within 72 hours of becoming aware of it, describing the nature of the breach and, where feasible, the categories and approximate numbers of data subjects and records concerned.
- Notify affected data subjects immediately after becoming aware of a breach likely to result in a high risk to their rights and freedoms.
- Give the Commission and every other relevant authority immediate information about a breach, whatever time you otherwise have, where that may help contain an imminent breach on a national scale, where containment may be needed nationally, sectorally or individually, or where the breach may affect the general public.
- Put in the notification the circumstances of the loss or unauthorised access or disclosure, the date or time period it occurred over, the personal information involved, an assessment of the risk of harm, an estimate of the number of individuals at real risk of significant harm, the steps you took to reduce that harm and to notify individuals, and the name and contact details of someone who can answer for you.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
- NIST CSF 2.0
- RS.CO-02Internal and external stakeholders are notified of incidents
- FINOS AIGF
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Who may demand the log
Regulator
Logging duty
Section 40(8) of the Act requires a controller and a processor to keep a record of all personal data breaches, whether or not notified, comprising the facts of the breach, its effects and the remedial action taken, in a manner that lets the Commission verify compliance. The record fields are descriptive and match none of the listed log-content values. The section sets no retention period. The 72-hour notice to the Commission in section 40(2) and the content list in Article 33(5) of the Directive are notification duties and are not themselves a record. The row cites no territorial clause, so no hook is read.
- Kind
- Explicit
- As of
- Provision
- Nigeria Data Protection Act, 2023, section 40(8)
- Trigger
- security_incident
What this law does
Article 33(1) quotes section 40(2) of the Act: a data controller shall, within 72 hours of becoming aware of a breach which is likely to result in a risk to the rights and freedoms of individuals, notify the Commission of the breach and, where feasible, describe its nature including the categories and approximate numbers of data subjects and personal data records concerned.
Article 33(2) fixes when a breach is likely to result in a high risk: where, considering its nature, the personal data involved and the probability of reaching the data subject's other personal data through it, the data subject may become a victim of fraud, identity theft or exposure of sensitive personal data. Article 33(3) requires the controller to notify affected data subjects immediately after becoming aware of the breach, so that they are not unlawfully targeted as a result of it.
Article 33(4) requires immediate information to the Commission and every other relevant authority, whatever the time otherwise allowed, where that may help contain an imminent breach on a national scale or where containment may be needed nationally, sectorally or individually, or where the breach may affect the general public.
Article 33(5) fixes the content of the notification: the circumstances of the loss or unauthorised access or disclosure, the date or time period it occurred over, a description of the personal information involved, an assessment of the risk of harm, an estimate of the number of individuals at real risk of significant harm, the steps taken to reduce that harm, the steps taken to notify individuals, and the name and contact details of a person who can answer for the organisation.
The General Application and Implementation Directive 2025, which carries the text quoted here, is made under section 37 of the 1999 Constitution and sections 1(a), 6(c), 61 and 62 of the Nigeria Data Protection Act 2023, an Act in force since .
When LexLint raises it
When your app profile says your app runs an essential service or processes personal data.
Back to the example · Lint your app
Page updated .