NigeriaNigeria Data Protection Act, 2023, sensitive personal data and a child's data
In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Consent, Age verification, Prohibition, DPIA
- Audit expectation
- none
What it requires
- Obtain a data subject's consent before processing sensitive personal data, and before processing the personal data of a child.NIST Privacy FrameworkCT.PO-P1
- Do not seek, give or accept consent in any circumstance that may propagate atrocities, hate, child rights violations or criminal acts.NIST Privacy FrameworkCT.PO-P1
- Where you deploy an emerging technology such as artificial intelligence, the Internet of Things or blockchain to process personal data, set technical and organisational parameters that take account of safeguards for sensitive personal data, safeguards for child rights and other vulnerable groups, the right against solely automated decisions, the right to be forgotten, cross-border data flows, and privacy by design and by default.NIST Privacy FrameworkGV.PO-P2
- Document those parameters and file them with the Commission as part of your Compliance Audit Returns, with an impact assessment that weighs disparate outcomes of the processing and the Data Subjects' Vulnerability Indexes in Schedule 6.NIST Privacy FrameworkID.RA-P4NIST Privacy FrameworkGV.MT-P4
- State in your Compliance Audit Returns whether you rely on consent for any of the activities article 18 lists.NIST Privacy FrameworkGV.MT-P4
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 1.6System requirements (e.g., “the system shall respect the privacy of its users”) are elicited from and understood by relevant AI actors. Design decisions take socio-technical implications into account to address AI risks.
- NIST Privacy Framework
- ID.RA-P4Problematic data actions, likelihoods, and impacts are used to determine and prioritize risk.
- GV.PO-P2Processes to instill organizational privacy values within system/product/service development and operations are established and in place.
- GV.MT-P4Policies, processes, and procedures for communicating progress on managing privacy risks are established and in place.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Who may demand the log
Regulator
Logging duty
Article 43(3) requires a controller or processor that deploys artificial intelligence, the Internet of Things or blockchain to process personal data to document the technical and organisational parameters it sets, including its safeguards for sensitive personal data and for child rights, and to file them with the Commission as part of its Compliance Audit Returns. Article 43(4)(a) has the impact assessment filed the same way. The clauses name no log field and no retention period. Article 43(4)(e) requires continuous monitoring of the technology once it is in use, which monitors the tool and not a record. Article 18 only requires the Returns to state whether the controller relies on consent. The Article 10 compliance audit sits outside the articles this row cites. The row cites neither the Act's scope section nor Article 1, so no territorial hook is read.
- Kind
- Implicit
- As of
- Provision
- GAID 2025, Article 43(3) and (4)(a)
- Trigger
- personal_data_processing
What this law does
Article 18(1) makes consent a requirement, on top of anything else the Act demands, for any direct marketing activity, for processing sensitive personal data, for further processing incompatible with the original purpose, for processing the personal data of a child, before personal data may be transferred to a country the Commission has made no adequacy decision for, and before a data controller makes a decision based solely on automated processing that produces legal effects concerning or significantly affecting the data subject; article 18(2) makes the Compliance Audit Returns state whether the controller or processor relies on consent for any of those activities.
Article 20(2) bars consent from being sought, given or accepted in any circumstance that may propagate atrocities, hate, child rights violations or criminal acts.
Article 43 binds a controller or processor deploying an emerging technology such as artificial intelligence, the Internet of Things or blockchain to set technical and organisational parameters for the processing that take account of the data subject's right not to be subject to a solely automated decision, the right to be forgotten, safeguards for processing sensitive personal data, safeguards for child rights and other vulnerable groups, the regulation of cross-border data flows, and privacy by design and by default; those parameters are documented and filed with the Commission as part of the Returns, and an impact assessment must weigh disparate outcomes and the Data Subjects' Vulnerability Indexes in Schedule 6.
Section 65 of the Act defines sensitive personal data to include genetic and biometric data processed for the purpose of uniquely identifying a natural person, so the consent requirement for sensitive personal data reaches such data. The General Application and Implementation Directive 2025, which carries the text quoted here, is made under section 37 of the 1999 Constitution and sections 1(a), 6(c), 61 and 62 of the Nigeria Data Protection Act 2023, an Act in force since .
When LexLint raises it
When your app profile says your app serves under-18s, makes high-risk automated decisions or sends automated outreach.
Back to the example · Lint your app
Page updated .