Nigeria Ushers in New Era of Data Protection with Landmark Law

President Bola Tinubu has signed the Nigeria Data Protection Bill 2023 into law. The new legislation provides a comprehensive legal framework for the protection of personal data and the practice of data protection in Nigeria.

The Nigeria Data Protection Bill, initially proposed by former President Muhammadu Buhari, was transmitted to the Senate and House of Representatives for consideration and passage on April 4, 2023. The bill’s passage marks a significant milestone in Nigeria’s data protection landscape, replacing the Nigeria Data Protection Bureau (NDPB) established by President Buhari in February 2022.

The new law establishes the Nigeria Data Protection Commission, which will be led by a National Commissioner responsible for regulating the processing of personal information. Dr. Vincent Olatunji, the National Commissioner of the NDPB, announced this development at the NDPD Strategic Roadmap and Action Plan (SRAP) validation workshop in Abuja.

The legislation outlines principles for the processing of personal data, including that it must be done in a fair, lawful, and transparent manner. It also states that the burden of proof lies with the data controller to establish that they received the consent of the data subject before collecting their data. Silence or inactivity of the data subject will not be taken to imply consent.

The law also prohibits the cross-border transfer of personal data, except if there is legal backing for it. All data controllers and processors of significant importance must register with the Commission within six months after the commencement of the Act.

This legislation is a welcome development in Nigeria, where personal data is often collected with no assurance of protection. The new law will put a better framework around protecting personal information and ensuring they won’t fall into the wrong hands.

The signing of the Nigeria Data Protection Bill into law is the third law President Tinubu has assented to barely three weeks after his inauguration. This move underscores the administration’s commitment to strengthening the country’s legal and regulatory frameworks, particularly in the area of data protection and privacy.