NIGERIA LAW AND PRACTICE Contributed by: Chinyerugo Ugoji, Tiwalola Osazuwa, Rebecca Ebokpo, Jibrin Dasun, Peretimi Akinmodun, Onyinyechi Chima and Princess Otah, ǼLEX
Pursuant to its powers under the NDPA, the NDPC issued the GAID in March 2025. The GAID will take effect from 19 September 2025, and revokes the NDPR and the NDPR IF, which will cease to be applicable as data protection regula -
• fostering the development of personal data protection technologies in accordance with recognised international best practices and applicable international law; • registration of data controllers and data pro - cessors of major importance; • where necessary, accreditation, licensing and registration of suitable persons to provide data protection compliance services; • promotion of public awareness on the obli - gations of data controllers and processors under the NDPA; • ensuring compliance with national and inter - national personal data protection obligations and best practice; • participating in international fora and engag - ing with national and regional authorities responsible for data protection with a view to developing efficient strategies for the regula - tion of cross-border transfers of personal data; • determining whether countries, regions, busi - ness sectors, binding corporate rules, con - tractual clauses, codes of conduct or certifi - cation mechanisms afford adequate personal data protection standards for cross-border transfers; • collecting and publishing information with respect to personal data protection, including personal data breaches; • advising the government on policy issues relating to data protection and privacy; and • receiving complaints relating to violations of the NDPA or subsidiary legislation made under the NDPA. The NDPC is also empowered by the NDPA to: • prescribe fees payable by data controllers and processors in accordance with data pro - cessing activities;
tory instruments in Nigeria. 8.2 Geographical Scope
The NDPA is applicable to the processing of data, whether by automated means or not, where: • the data controller or processor is domiciled, resident or operating in Nigeria; • the processing of personal data occurs within Nigeria; or • the data controller or processor is not domi - ciled, resident or operating in Nigeria but is processing the personal data of a data sub - ject in Nigeria. In addition to the instances listed above, the GAID includes Nigerian citizens as a class of persons to which the NDPA would apply, wheth - er or not domiciled in Nigeria. However, this is subject to applicable international laws, and the data controller’s obligation in this instance is lim - ited only to the terms of mutual legal assistance between Nigeria and the foreign country and any applicable international law. 8.3 Role and Authority of the Data Protection Agency The NDPC was established by the NDPA as the data protection authority in Nigeria, and is charged with overseeing the implementation of the provisions of the NDPA. The role of the NDPC includes: • regulation of the deployment of technical and organisational measures to enhance personal data protection;
584 CHAMBERS.COM
Powered by FlippingBook