NIGERIA DATA PROTECTION ACT, 2023
ACT No. 37
AN ACT TO PROVIDE A LEGAL FRAMEWORK FOR THE PROTECTION OF PERSONAL
INFORMATION, AND ESTABLISH THE NIGERIA DATA PROTECTION COMMISSION FOR THE
REGULATION OF THE PROCESSING OF PERSONAL INFORMATION ;
AND FOR RELATED MATTERS

• Part 01 – Objectives and Application
  • Article 01: Objectives
  • Article 02: Application
  • Article 03: Exemption of Application
• Part 02 – Establishment of the Nigeria Data Protection Commission and its Governing Council
  • Article 04: Establishment of the Nigeria Data Protection Commission
  • Article 05: Functions of the Commission
  • Article 06: Powers of the Commission
  • Article 07: Independence of the Commission
  • Article 08: Establishment of the Governing Council of the Commission
  • Article 09: Appointment of members of the Council
  • Article 10: Tenure of members of the Council
  • Article 11: Cessation of Membership
  • Article 12: Functions and Powers of the Council
  • Article 13: Conflict of Interest
• Part 03 – Appointment of the National Commissioner, and Other Staff of the Commission
  • Article 14: Appointment of the National Commissioner for the Commission
  • Article 15: Secretary to the Council
  • Article 16: Staff of the Commission
  • Article 17: Staff Regulations and Discipline
  • Article 18: Pension
• Part 04 – Financial Provisions
  • Article 19: Funds of the Commission
  • Article 20: Expenditure of the Fund
  • Article 21: Power to Borrow and Accept Gifts
  • Article 22: Account and Audit
  • Article 23: Annual Reports and Estimates
• Part 05 – Principles and Lawful Basis Governing Processing of Personal Data
  • Article 24: Principles of Personal Data Processing
  • Article 25: Lawful Basis of Personal Data Processing
  • Article 26: Consent
  • Article 27: Provision of Information to the Data Subject
  • Article 28: Data Privacy Impact Assessment
  • Article 29: Obligations of the Data Controller and Data Processor
  • Article 30: Sensitive Personal Data
  • Article 31: Children or Persons Lacking the Legal Capacity to Consent
  • Article 32: Data Protection Officers
  • Article 33: Data Protection Compliance Services
• Part 06 – Rights of a Data Subject
  • Article 34: Rights of a Data Subject
  • Article 35: Withdrawal of Consent
  • Article 36: Right to Object
  • Article 37: Automated Decision Making
  • Article 38: Data Portability
• Part 07 – Data Security
  • Article 39: Security, Integrity and Confidentiality
  • Article 40: Personal Data Breaches
• Part 08 – Cross-Border Transfers of Personal Data
  • Article 41: Basis for Cross-Border Transfer of Personal Data
  • Article 42: Adequacy of Protection
  • Article 43: Other Bases for Transfer of Personal Data outside Nigeria
• Part 09 – Registration and Fees
  • Article 44: Registration of Data Controllers and Data Processors of Major Importance
  • Article 45: Fees and Levies
• Part 10 – Enforcement
  • Article 46: Complaints and Investigations
  • Article 47: Compliance Orders
  • Article 48: Enforcement Orders
  • Article 49: Offences and Penalties
  • Article 50: Judicial Review
  • Article 51: Civil Remedies
  • Article 52: Forfeiture
  • Article 53: Joint and Vicarious Liability
• Part 11 – Legal Proceedings
  • Article 54: Limitation of Suits against the Commission
  • Article 55: Service of Documents
  • Article 56: Restriction on Execution against Property of the Commission
  • Article 57: Indemnity of staff, members, and employees of the Commission
  • Article 58: Power of Arrest, Search, and Seizure
  • Article 59: Right to Appear in Court
• Part 12 – Miscellaneous Provisions
  • Article 60: Directives by the Minister
  • Article 61: Regulations
  • Article 62: Directives, Codes, and Guidelines
  • Article 63: Priority of the Act
  • Article 64: Transitional Provisions
  • Article 65: Interpretation
  • Article 66: Citation
• SCHEDULE
  • 01 – Council to Regulate Proceedings
  • 02 – Presiding Officer
  • 03 – Quorum
  • 04 – Voting
  • 05 – Teleconference Meeting
  • 06 – Committees of the Council
  • 07 – Seal of the Commission
  • 08 – Miscellaneous