FACTS ABOUT DATA PROTECTION IN NIGERIA. (PHOTO).

Facts About Data Protection in Nigeria

In an era dominated by digital interactions, protecting personal data has become a critical aspect of ensuring individuals’ privacy and security. The rapid integration of technology into every aspect of our lives has ushered in unprecedented conveniences, but it has also exposed us to a myriad of potential threats.

Personal data protection is a fundamental right that every Nigerian internet user should be aware of and exercise. Personal data is any information that can identify or relate to an individual, such as name, address, phone number, email, biometric data, health records, etc.

Recognising the importance of safeguarding citizens’ information, Nigeria took a significant step by enacting the Nigeria Data Protection Act 2023 (NDPA), marking a landmark move in the country’s commitment to digital rights.

The Nigeria Data Protection Act 2023 (NDPA) applies to both individuals and organisations, whether natural or legal entities, involved in processing personal data within or outside Nigeria. This legislation establishes the Nigeria Data Protection Commission (NDPC) as the regulatory body responsible for overseeing and enforcing the provisions of the NDPA. The NDPC is tasked with enforcing the NDPA, issuing guidelines, and handling investigations and sanctions for those who violate the regulations.

Data subjects, under the NDPA, enjoy various rights, including being informed about data processing purposes, access, rectification, erasure, and objection to data processing. They also have the right to data portability, the ability to withdraw consent, and the right to file a complaint if there is an infringement.

Your rights under the NDPA

The scope of the Nigeria Data Protection Act is broad, addressing the processing and protection of personal data. The Act provides data subjects with a number of rights and obligations in relation to their personal data, including:

The right to be informed about the purpose, nature, and extent of the processing of their personal data.

The right to access, rectify, erase, restrict, or object to the processing of their personal data.

The right to data portability, which allows data subjects to receive their personal data in a structured, commonly used, and machine-readable format and to transmit it to another data controller without hindrance.

The right to withdraw consent at any time, where the processing is based on consent.

The right to lodge a complaint with the NDPC or a court of competent jurisdiction, where the data subject believes that their rights have been infringed or their personal data has been unlawfully processed.

The obligation to provide accurate, complete, and up-to-date personal data to data controllers and processors, and to notify them of any changes or corrections.

The obligation to respect the confidentiality and security of their personal data and to avoid disclosing it to unauthorised parties.

Responsibilities of personal data handlers

The NDPA also imposes several duties and responsibilities on data controllers and processors, such as:

The duty to obtain the consent of data subjects before processing their personal data, unless the processing is necessary for the performance of a contract, compliance with a legal obligation, protection of vital interests, performance of a task in the public interest, or legitimate interests of the data controller or a third party.

The duty to process personal data lawfully, fairly, transparently, and in accordance with the principles of data minimization, purpose limitation, accuracy, storage limitation, integrity, and confidentiality.

The duty to implement appropriate technical and organisational measures to ensure the security and protection of personal data against unauthorised or unlawful access, alteration, disclosure, destruction, or loss.

The duty to notify the NDPC and the data subjects of any personal data breach within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of data subjects.

The duty to conduct a data protection impact assessment (DPIA) before engaging in any processing that may pose a high risk to the rights and freedoms of data subjects, and to consult with the NDPC where the DPIA indicates that the risk cannot be mitigated.

The duty to appoint a data protection officer (DPO) where the processing involves regular and systematic monitoring of data subjects, large-scale processing of sensitive personal data, or processing by a public authority or body.

The duty to register with the NDPC and to comply with its guidelines, codes of conduct, standards, and regulations.

Outcomes of violation of NDPA

The NDPA provides for various sanctions and remedies for the violation of its provisions, such as:

Administrative fines ranging from N10,000,000 to N100,000,000, or 2% to 4% of the annual global turnover of the data controller or processor, whichever is higher.

Criminal penalties of imprisonment for a term not exceeding three years, a fine not exceeding N10,000,000, or both.

Civil remedies of compensation for damages suffered by data subjects as a result of the unlawful processing of their personal data.

The Nigeria Data Protection Act is landmark legislation that aims to protect the privacy and dignity of Nigerian netizens and promote the development of the digital economy in Nigeria. The NDPA aligns with global standards and best practises in data protection, like the General Data Protection Regulation (GDPR) of the European Union.

It also reflects the African Union Convention on Cyber Security and Personal Data Protection (Malabo Convention) and the ECOWAS Supplementary Act on Personal Data Protection.

The NDPA is a welcome development for Nigerian netizens, who can now enjoy greater control and security over their personal data and exercise their rights and obligations under the NDPA. The NDPA also creates a conducive environment for data controllers and processors, who can benefit from the trust and confidence of data subjects and the harmonisation of data protection laws across jurisdictions. The NDPA is a significant step towards achieving the vision of a digital Nigeria that respects and protects the rights and interests of its citizens.