Data protection laws in Nigeria
Principal regulation
Nigeria Data Protection Act 2023 (NDPA)
The NDPA has been enacted to safeguard the fundamental rights and freedoms, and the interests of data subjects, as guaranteed under the Constitution of the Federal Republic of Nigeria. Among other things, the objective of the NDPA include: the protection of personal information; establishment the Nigeria Data Protection Commission (NDPC) for the regulation of the processing of personal information; promotion of data processing practices that safeguard the security of personal data and privacy of data subjects; protection of data subjects’ rights, and provision of means of recourse and remedies, in the event of the breach of the data subjects’ rights; and strengthening the legal foundations of the national digital economy and guarantee the participation of Nigeria in the regional and global economies through the beneficial and trusted use of personal data etc. The NDPA received Presidential assent on 13 June 2023.
Subsidiary legislation
There is subsidiary legislation that provides guidance, rules and procedures to implement and enforce the provisions of the NDPA. The legislation include:
General Application and Implementation Directive 2025 (GAID)
The GAID was issued on 20 March 2025 by the NDPC pursuant to its powers under the NDPA. With the issuance of the GAID, the Nigeria Data Protection Regulation 2019 and its Implementation Framework of 2020 ceased to apply. The NDPA and the GAID together now constitute the complete governing framework for data protection in Nigeria. The GAID provides comprehensive and binding directives for implementing the NDPA, addressing topics including: scope and applicability of the NDPA; lawful bases for data processing; designation and registration of data controllers and processors of major importance; the role of Data Protection Officers; compliance audit returns; cross-border data transfers; data breach notifications; data ethics; and the exercise of data subjects’ rights. The GAID also introduces several Schedules covering, inter alia, Principles of Data Protection, Data Privacy Impact Assessment templates, Cross-Border Data Transfer guidance, Data Subject Vulnerability Indexes, and registration guidance for data controllers and processors of major importance.
Guidelines for the Management of Personal Data by Public Institutions in Nigeria 2020 (Guidelines)
The Guidelines apply to all public institutions (PIs) in Nigeria, including ministries, departments, agencies, institutions, public corporations, publicly funded ventures, and incorporated entities with government shareholding, either at the Federal, State or Local levels, that process the personal data of a data subject. The Guidelines mandate all PIs to protect personal data in any incidence of processing such data. Processing in this context retains the same meaning it has under the NDPA. All forms of personal data of a Nigerian citizen, resident or non-Nigerian individual that has interactions with PIs, or such PIs have access to the personal data in furtherance of a statutory or administrative purpose, are to be protected in accordance with the NDPA or any other law or regulation in force in Nigeria.
Sectoral laws
In addition to the principal and subsidiary legislation mentioned, the Constitution of the Federal Republic of Nigeria and various sector-specific laws make different provisions for privacy and data protection matters. Key provisions in the mentioned laws are outlined hereunder:
The laws
Constitution of the Federal Republic of Nigeria 1999 (As Amended) (Constitution)
The Constitution provides Nigerian citizens with a fundamental right to privacy. Section 37 of the Constitution guarantees privacy protections to citizens in their homes, correspondence, telephone conversations and telegraphic communications. The Constitution neither defines the scope of privacy nor contains detailed privacy provisions.
Child Rights Act 2003 (Act)
The Act reiterates the constitutional right to privacy as it relates to children. Section 8 of the Act guarantees a child’s right to privacy subject to parent or guardian rights to exercise supervision and control of their child’s conduct. Some Nigerian states have also enacted Child Rights Laws. Under the Act / Laws, age of a child is any person under the age of 18.
Consumer Code of Practice Regulations 2007 (NCC Regulations)
The Nigerian Communications Commission (NCC) issued the NCC Regulations which requires all licensees to take reasonable steps to protect customer information against improper or accidental disclosure and ensure that such information is securely stored and not kept longer than necessary. The NCC Regulations further prohibit the transfer of customer information to any party except to the extent agreed with the customer, as permitted or required by the NCC or other applicable laws or regulations.
Consumer Protection Framework 2016 (Framework)
The Framework was enacted pursuant to the Central Bank of Nigeria Act 2007. The Framework includes provisions that prohibit financial institutions from disclosing customers’ personal information. The Framework further requires that financial institutions have appropriate data protection measures and staff training programs in place to prevent unauthorized access, alteration, disclosure, accidental loss or destruction of customer data. Financial services providers must obtain written consent from consumers before personal data is shared with a third party or used for promotional offers.
Credit Reporting Act 2017 (CRA)
The CRA establishes a legal and regulatory framework for credit reporting by Credit Bureaus. Section 5 of the CRA requires Credit Bureaus to maintain credit information for at least 6 years from the date that such information is obtained, after which the information must be archived for a 10-year period prior to its destruction. Section 9 of the CRA provides the rights of data subjects (i.e. persons whose credit data are held by a Credit Bureau) to privacy, confidentiality and protection of their credit information. Section 9 further prescribes conditions under which the credit information of the data subject may be disclosed.
Cybercrimes (Prohibition, Prevention Etc) (Amendment) Act, 2024 (Cybercrimes Act)
The Cybercrimes Act provides a legal and regulatory framework that prohibits, prevents, detects, prosecutes and punishes cybercrimes in Nigeria. The Cybercrimes Act requires financial institutions to retain and protect data and criminalizes the interception of electronic communications.
Freedom of Information Act, 2011 (FOI Act)
The FOI Act seeks to protect personal privacy. Section 14 of the FOI Act provides that a public institution is obliged to deny an application for information that contains personal information unless the individual involved consents to the disclosure, or where such information is publicly available. Section 16 of the FOI Act provides that a public institution may deny an application for disclosure of information that is subject to various forms of professional privilege conferred by law (such as lawyer-client privilege, health workers-client privilege, etc.).
National Identity Management Commission Act 2007 (NIMC Act)
The NIMC Act creates the National Identity Management Commission (NIMC) to establish and manage a National Identity Management System (NIMS). The NIMC is responsible for enrolling citizens and legal residents, creating and operating a National Identity Database and issuing Unique National Identification Numbers to qualified citizens and legal residents. Section 26 of the NIMC Act provides that no person or corporate body shall have access to data or information in the Database with respect to a registered individual without authorization from the NIMC. The NIMC is empowered to provide a third party with information recorded in an individual’s Database entry without the individual’s consent, provided it is in the interest of National Security.
National Health Act 2014 (NH Act)
The NH Act provides rights and obligations for health users and healthcare personnel. Under the NH Act, health establishments are required to maintain health records for every user of health services and maintain the confidentiality of such records. The NH Act further imposes restrictions on the disclosure of user information, and requires persons in charge of health establishments to set up control measures for preventing unauthorized access to information. The NH Act applies to all information relating to patient health status, treatment, and admittance into a health establishment, and further applies to DNA samples collected by a health establishment.
Nigerian Communications Commission (registration of telephone subscribers) Regulation 2011 (Regulation)
Section 9 and 10 of the Regulation provides confidentiality for telephone subscribers’ records maintained in the NCC’s central database. The Regulation further provides telephone subscribers with a right to view and update personal information held in the NCC’s central database of a telecommunication company in camera.
