Data Protection in Nigeria

Definitions in Nigeria

Definition of Personal Data

Personal Data is defined as any information relating to an individual, who can be identified or is identifiable, directly or indirectly, by reference to an identifier such as a name, an identification number, location data, an online identifier or one or more factors specific to the physical, physiological, genetic, psychological, cultural, social, or economic identity of that individual.

Definition of Personal Data Breach

Personal Data Breach is defined as a breach of security of a data controller or data processor leading to or likely to lead to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored, or otherwise processed.

Definition of Data Subject

Data Subject means an individual to whom personal data relates.

Definition of Data Controller

Data Controller means an individual, private entity, public Commission, agency or any other body who, alone or jointly with others, determines the purposes and means of processing of personal data.

Definition of Processing

Processing means any operation or set of operations which is performed on personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment, combination, restriction, erasure or destruction and does not include the mere transit of data originating outside Nigeria.

Definition of Sensitive Personal Data

Sensitive Personal Data means personal data relating to an individual’s:

  • genetic and biometric data, for the purpose of uniquely identifying a natural person,
  • race or ethnic origin, 
  • religious or similar beliefs, such as those reflecting conscience or philosophy,
  • health status,
  • sex life, 
  • political opinions or affiliations,
  • trade union memberships, or 
  • other information prescribed by the Commission as sensitive personal data.
Back to top