Notwithstanding any criminal sanctions under this Act, if the Commission, after completing an investigation under Section 046 of this Act, is satisfied that a data controller or data processor has violated any provision of this Act or subsidiary legislation...

An enforcement order made or sanction imposed under subsection (1) shall include — (a) requiring the data controller or data processor to remedy the violation; (b) ordering the data controller or data processor to pay compensation to a data subject, w...

A penalty or remedial fee under subsection (2)(d) may be an amount up to the — (a) higher maximum amount, in the case of a data controller or data processor of major importance; or (b) standard maximum amount, in the case of a data controller o...

The “higher maximum amount” shall be the greater of — (a) N10,000,000, and (b) 2% of its annual gross revenue in the preceding financial year.

The “standard maximum amount” shall be the greater of — (a) N2,000,000, and (b) 2% of its annual gross revenue in the preceding financial year.

The Commission shall, in determining the sanctions, take into consideration the — (a) nature, gravity, and duration of the infringement; (b) purpose of the processing; (c) number of data subjects involved; (d) level of damage and damage m...