Regulatory Updates
Nigeria’s Data Protection Act, Two Years On
In short: The headline duties are settled; the open questions are now about enforcement posture and cross-border transfer mechanics.
The headline duties are settled; the open questions are now about enforcement posture and cross-border transfer mechanics.
Data controller of major importance
A threshold classification that brings additional registration and reporting duties. Whether you cross it is a question of scale and sensitivity, not sector alone.
Where the live questions sit
Two years in, the duties themselves are not seriously contested. What remains unsettled is how they are enforced in practice, and how transfers out of Nigeria are documented.
- Registration thresholds and who actually crosses them
- Transfer mechanics where no adequacy finding exists
- What a regulator asks for first in an enquiry
The pragmatic move is to decide the standard once, document the reasoning, and revisit only when a primary source actually moves. That keeps the work defensible and stops the team re-litigating settled questions every quarter.
Primary sources
- Nigeria Data Protection Act 2023 Nigeria Data Protection Commission
Common questions
- Does the NDPA apply to companies outside Nigeria?
- It can, where the processing relates to data subjects in Nigeria. Establishment is not the only trigger.