Nigeria

Article 33(1) quotes section 40(2) of the Act: a data controller shall, within 72 hours of becoming aware of a breach which is likely to result in a risk to the rights and freedoms of individuals, notify the Commission of the breach and, where feasible, describe its nature including the categories and approximate numbers of data subjects and personal data records concerned.

Article 33(2) fixes when a breach is likely to result in a high risk: where, considering its nature, the personal data involved and the probability of reaching the data subject's other personal data through it, the data subject may become a victim of fraud, identity theft or exposure of sensitive personal data. Article 33(3) requires the controller to notify affected data subjects immediately after becoming aware of the breach, so that they are not unlawfully targeted as a result of it.

Article 33(4) requires immediate information to the Commission and every other relevant authority, whatever the time otherwise allowed, where that may help contain an imminent breach on a national scale or where containment may be needed nationally, sectorally or individually, or where the breach may affect the general public.

Article 33(5) fixes the content of the notification: the circumstances of the loss or unauthorised access or disclosure, the date or time period it occurred over, a description of the personal information involved, an assessment of the risk of harm, an estimate of the number of individuals at real risk of significant harm, the steps taken to reduce that harm, the steps taken to notify individuals, and the name and contact details of a person who can answer for the organisation.

The General Application and Implementation Directive 2025, which carries the text quoted here, is made under section 37 of the 1999 Constitution and sections 1(a), 6(c), 61 and 62 of the Nigeria Data Protection Act 2023, an Act in force since 12 June 2023.

Article 7 of the Directive lists the general compliance measures the Act expects of every data controller and data processor: registering with the Commission as one of major importance where the Commission so determines, conducting a compliance audit within fifteen months of commencing business and annually thereafter, filing Compliance Audit Returns by 31 March each year in the Ultra-High and Extra-High Level categories, identifying every obligation under the Act and scheduling compliance with it, keeping semi-annual data protection reports, and following schedules for monitoring, evaluating and maintaining the data security system and for internal sensitisation and training.

Article 9 governs registration as a data controller or data processor of major importance, requires the Ultra-High and Extra-High Level categories to register once and file Returns annually, requires the Ordinary-High Level category to renew registration annually instead, and requires notice to the Commission of any significant change to registered information within sixty days.

Articles 11 to 14 govern the designation, position, semi-annual reporting and credential assessment of the Data Protection Officer that section 32 of the Act mandates. Articles 15 to 17 and 20 to 26 carry the principles of section 24 and the lawful bases of section 25, and article 19 governs consent to cookies and other tracking tools.

Article 28 carries the Data Privacy Impact Assessment that section 28 of the Act mandates where processing may result in high risk, article 29 the monitoring, evaluation and maintenance of the data security system that section 39 requires, article 31 the duties that attach to deploying data processing software, and article 34 the Data Processing Agreement that section 29(2) requires between a controller and its processor.

The General Application and Implementation Directive 2025, which carries the text quoted here, is made under section 37 of the 1999 Constitution and sections 1(a), 6(c), 61 and 62 of the Nigeria Data Protection Act 2023, an Act in force since 12 June 2023.

Article 45 states that Part VIII of the Act provides for cross-border data transfer and, by section 63, is the overarching governing provision for every transfer of personal data out of Nigeria; pending any further regulatory instrument, the explanatory note in Schedule 5 is used to evaluate countries for adequacy and for the other grounds the Act recognises, and the Commission is to weigh the enforcement of fundamental rights and the decisions of courts advancing fundamental freedoms in a jurisdiction it considers.

Schedule 5 lists the grounds for transfer as an adequacy decision by the Commission, a Cross-Border Data Transfer Instrument the Commission approves, and other lawful bases, and sets out what the Commission weighs in adjudging a country adequate under section 42(2) of the Act: enforceable data subject rights with administrative or judicial redress and the rule of law, any instrument between the Commission and a competent authority in the recipient jurisdiction, the terms on which a public authority there reaches personal data, the existence of an effective data protection law that is in force and not subject to an overriding law, and a functioning independent supervisory authority with adequate enforcement powers.

The instruments the Commission may approve in the absence of an adequacy decision are codes of conduct, certifications, binding corporate rules and standard contractual clauses. Consent is separately required before personal data may be transferred to a country for which the Commission has made no adequacy decision.

The General Application and Implementation Directive 2025, which carries the text quoted here, is made under section 37 of the 1999 Constitution and sections 1(a), 6(c), 61 and 62 of the Nigeria Data Protection Act 2023, an Act in force since 12 June 2023.

Article 27 requires the information given to a data subject under section 27 of the Act to be clear and to take the data subject's circumstances into account.

Article 36 makes the right to rectification part of the accuracy principle, requires the platform through which personal data is processed to give an effective opportunity to rectify, bars requiring an affidavit or a newspaper publication where the correction aligns the data with the data subject's National Identification Number, and bars charging a data subject to correct an error that was not their fault.

Article 37 gives a right to data portability where the data subject supplied the personal data on the basis of consent or where the processing is necessary to perform a contract, without prejudice to the rights of other data subjects in the same set or to the right of erasure.

Article 38 gives a right to be forgotten where the data is no longer necessary for the purpose it was collected for, where consent is withdrawn and was the lawful basis, where the data subject objects to processing founded on legitimate interest and no overriding ground exists, where the processing is for direct marketing and the data subject objects, where the processing was unlawful, or where erasure is needed to comply with a legal ruling or obligation.

Article 39 makes the right to lodge a complaint with the Commission a threshold right of redress under section 37 of the 1999 Constitution and section 46 of the Act, and requires every instrument about processing personal data to carry a clause on it. Article 40 provides the Standard Notice to Address Grievance in Schedule 9, which an aggrieved data subject may serve directly on a controller or processor without it being a condition of complaining to the Commission.

Article 43(2)(a) carries the right of a data subject not to be subject to a decision solely based on automated processes or algorithms. The General Application and Implementation Directive 2025, which carries the text quoted here, is made under section 37 of the 1999 Constitution and sections 1(a), 6(c), 61 and 62 of the Nigeria Data Protection Act 2023, an Act in force since 12 June 2023.

Article 39 makes the right to lodge a complaint with the Nigeria Data Protection Commission a threshold right of redress under section 37 of the 1999 Constitution and section 46 of the Act, requires the Commission to run an electronic platform for complaints and to acknowledge one within seven days while continuing to accept complaints by any reasonable means, and requires it to carry out a preliminary evaluation of each complaint; a Pre-Action Conference may be held as often as a complaint or an investigation under section 46(3) needs.

Article 47 confirms that a data subject may seek redress for a violation of their data privacy rights in court, and treats proximity and access to courts as part of what national adequacy means.

Article 48 governs how the Commission weighs evidence of compliance: registration, annual Compliance Audit Returns, a filed impact assessment and an approved cross-border transfer instrument show accountability and prima facie good faith, but do not replace concrete evidence in defence of a complaint about any other provision, and the Commission treats accountability as partial fulfilment of the cooperation section 48(6)(f) of the Act requires.

Article 49 makes the safeguarding of a data subject's constitutional privacy right the overriding consideration in judging whether an obligation was met in time. The General Application and Implementation Directive 2025, which carries the text quoted here, is made under section 37 of the 1999 Constitution and sections 1(a), 6(c), 61 and 62 of the Nigeria Data Protection Act 2023, an Act in force since 12 June 2023.

Article 18(1) makes consent a requirement, on top of anything else the Act demands, for any direct marketing activity, for processing sensitive personal data, for further processing incompatible with the original purpose, for processing the personal data of a child, before personal data may be transferred to a country the Commission has made no adequacy decision for, and before a data controller makes a decision based solely on automated processing that produces legal effects concerning or significantly affecting the data subject; article 18(2) makes the Compliance Audit Returns state whether the controller or processor relies on consent for any of those activities.

Article 20(2) bars consent from being sought, given or accepted in any circumstance that may propagate atrocities, hate, child rights violations or criminal acts.

Article 43 binds a controller or processor deploying an emerging technology such as artificial intelligence, the Internet of Things or blockchain to set technical and organisational parameters for the processing that take account of the data subject's right not to be subject to a solely automated decision, the right to be forgotten, safeguards for processing sensitive personal data, safeguards for child rights and other vulnerable groups, the regulation of cross-border data flows, and privacy by design and by default; those parameters are documented and filed with the Commission as part of the Returns, and an impact assessment must weigh disparate outcomes and the Data Subjects' Vulnerability Indexes in Schedule 6.

The General Application and Implementation Directive 2025, which carries the text quoted here, is made under section 37 of the 1999 Constitution and sections 1(a), 6(c), 61 and 62 of the Nigeria Data Protection Act 2023, an Act in force since 12 June 2023.

Section 6(1) makes it an offence for any person, without authorisation, to intentionally access in whole or in part a computer system or network for a fraudulent purpose and to obtain data vital to national security, punishable by imprisonment for not more than five years or a fine of not more than N5,000,000, or both.

Section 6(2) raises the penalty to imprisonment for not more than seven years or a fine of not more than N7,000,000, or both, where the access is committed with the intent of obtaining computer data, securing access to a program, or obtaining commercial, industrial, or classified information.

Section 6(1)'s own text conditions the offence on a fraudulent purpose and on the data obtained being vital to national security, so a plain reading of that subsection does not reach ordinary scraping of a public, unauthenticated page absent both elements; section 6(2)'s aggravated form reaches a wider set of intents but is only reached once subsection (1)'s unauthorised-access element is made out. No reported Nigerian decision has applied section 6 to a scraper.

Section 21 of the Cybercrimes (Prohibition, Prevention, etc.) Act, 2015 requires any person or institution, whether public or private, that operates a computer system or network in Nigeria to immediately inform the National Computer Emergency Response Team (CERT) Coordination Center of any attack, intrusion, or other disruption liable to hinder the functioning of another computer system or network, so that the National CERT can take the necessary measures to address the issue.

The National CERT Coordination Center may propose isolating an affected computer system or network pending resolution. A person or institution that fails to report such an incident to the National CERT within 7 days of its occurrence commits an offence and is liable to denial of internet services, and must in addition pay a mandatory fine of N2,000,000 into the National Cyber Security Fund.

The Office of the National Security Adviser is the Act's own coordinating body for all security and enforcement agencies under it.

The Code of Practice for Interactive Computer Service Platforms/Internet Intermediaries, issued by the National Information Technology Development Agency (NITDA) under section 6 of the NITDA Act, 2007 in collaboration with the Nigerian Communications Commission and the National Broadcasting Commission, applies to all Interactive Computer Service Platforms and Internet Intermediaries operating in Nigeria, a term the Code defines broadly to include social media operators, websites, blogs, media-sharing sites, discussion forums, streaming platforms, and gaming platforms.

Part II requires a Platform to label, censor, redact, or otherwise apply access control so that content inappropriate for a child, such as sexually explicit content or images of violence, is not viewable to a child. Part II also requires a Platform to inform users through its terms of service not to create, publish, modify, transmit, store, or share content harmful to a child.

A Platform must also give consideration, in assessing whether content is harmful, to the risk that its dissemination could have a physical or psychological impact on a child or an adult, and must ensure its community rules specify how children will be protected from harmful content they may encounter.

The Code does not itself prescribe an age-verification mechanism, and non-compliance is stated to be a breach of the Nigerian Communications Act, 2003, the National Broadcasting Commission Act, 2004, and the NITDA Act, 2007, rather than a penalty set out in the Code itself.

Section 20(1) of the Copyright Act, 2022 excludes several acts from the exclusive rights conferred by sections 9 to 13, by way of fair dealing, including private use, parody, satire, pastiche, or caricature, non-commercial research and private study, and criticism, review, or the reporting of current events, subject to acknowledging the title and author where the use is public, except where the work is incidentally included in a broadcast.

The excluded acts also include the inclusion of an artistic work situated in a public place in an audiovisual work or broadcast, the incidental inclusion of an artistic work in an audiovisual work or broadcast, and reading or recitation in public or in a non-commercial broadcast of a reasonable extract from a published literary work, with acknowledgment. Separately excluded are quotations in the form of short excerpts from a work.

Also excluded is news of the day for public broadcast or publicly communicated by any other means. Section 20(1)(d)'s proviso conditions the criticism, review, and current-events exception on a fairness test weighing the purpose and character of the use, the nature of the work, the amount and substantiality of the portion used, and the effect of the use on the potential market or value of the work.

Section 20 carries no headline-length or short-extract cap distinct from these tests, and no reported Nigerian decision applies it to a systematic news aggregator rather than an individual quoting or reporting on a published work. Related rights under the Act, covering performers, sound recordings, broadcasts, and expressions of folklore, do not extend to a print or online news publisher's own reporting.