NigeriaNigeria Data Protection Act, 2023, rights of a data subject
In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights, Disclosure
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Give a data subject an effective opportunity to rectify their personal data on the platform you process it through, without requiring an affidavit or a newspaper publication where the correction aligns the data with their National Identification Number, and without charging them for an error that was not their fault.NIST Privacy FrameworkCT.DM-P3
- Give effect to the right to data portability where the data subject supplied the personal data on the basis of consent or where the processing is necessary to perform a contract, without prejudice to the rights of other data subjects whose data is in the same set.NIST Privacy FrameworkCT.DM-P2
- Erase personal data on request where it is no longer necessary for its original purpose, where consent was the lawful basis and has been withdrawn, where the data subject objects to processing founded on legitimate interest and no overriding ground exists, where it is processed for direct marketing and the data subject objects, where it was processed unlawfully, or where a legal ruling or obligation requires erasure.NIST Privacy FrameworkCT.DM-P4
- Carry a clause on the right to lodge a complaint with the Commission in every regulation, policy, framework or legal instrument of yours that pertains to processing personal data, and answer a Standard Notice to Address Grievance a data subject serves on you.NIST Privacy FrameworkCM.AW-P1NIST Privacy FrameworkGV.MT-P7
- Give a data subject the information section 27 of the Act requires in clear terms, taking their circumstances into account.NIST Privacy FrameworkCM.AW-P1
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.MT-P7Policies, processes, and procedures for receiving, tracking, and responding to complaints, concerns, and questions from individuals about organizational privacy practices are established and in place.
- CT.DM-P2Data elements can be accessed for transmission or disclosure.
- CT.DM-P3Data elements can be accessed for alteration.
- CT.DM-P4Data elements can be accessed for deletion.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Who may demand the log
Regulator
Logging duty
Article 36(5) says that where a data subject disputes that they were given manifestly ample opportunity to verify their data before it was submitted in a permanent form, the controller or processor must provide the evidence of that opportunity, and that the processing platforms must be designed so that it can audit any source of error. That evidence and that audit cannot be produced without a record of what the data subject was shown and when. The clause names no log field and no retention period. Section 46(4) and (5) of the Act, which this row cites, let the Commission order the production of, or inspection of, any record relevant to an investigation. The row cites no territorial clause, so no hook is read.
- Kind
- Implicit
- As of
- Provision
- GAID 2025, Article 36(5)
- Trigger
- personal_data_processing
What this law does
Article 27 requires the information given to a data subject under section 27 of the Act to be clear and to take the data subject's circumstances into account.
Article 36 makes the right to rectification part of the accuracy principle, requires the platform through which personal data is processed to give an effective opportunity to rectify, bars requiring an affidavit or a newspaper publication where the correction aligns the data with the data subject's National Identification Number, and bars charging a data subject to correct an error that was not their fault.
Article 37 gives a right to data portability where the data subject supplied the personal data on the basis of consent or where the processing is necessary to perform a contract, without prejudice to the rights of other data subjects in the same set or to the right of erasure.
Article 38 gives a right to be forgotten where the data is no longer necessary for the purpose it was collected for, where consent is withdrawn and was the lawful basis, where the data subject objects to processing founded on legitimate interest and no overriding ground exists, where the processing is for direct marketing and the data subject objects, where the processing was unlawful, or where erasure is needed to comply with a legal ruling or obligation.
Article 39 makes the right to lodge a complaint with the Commission a threshold right of redress under section 37 of the 1999 Constitution and section 46 of the Act, and requires every instrument about processing personal data to carry a clause on it. Article 40 provides the Standard Notice to Address Grievance in Schedule 9, which an aggrieved data subject may serve directly on a controller or processor without it being a condition of complaining to the Commission.
The General Application and Implementation Directive 2025, which carries the text quoted here, is made under section 37 of the 1999 Constitution and sections 1(a), 6(c), 61 and 62 of the Nigeria Data Protection Act 2023, an Act in force since .
When LexLint raises it
When your app profile says your app sends automated outreach or processes personal data.
Back to the example · Lint your app
Page updated .