Data Protection Monitor
Global Privacy & Data Protection Intelligence

Nigeria (NG) · Module Detail

Nigeria: Algorithmic, Biometric & Surveillance Governance

← Full Nigeria overview Build report with Nigeria Request deeper dive

#

Automated decision-making right is confirmed in force; biometric, genetic, AI-risk-assessment and surveillance-carveout specifics remain largely unconfirmed or emergent.

Primary frameworkNigeria Data Protection Act, 2023 (NDPA), Section 37
Supervisory authorityNigeria Data Protection Commission (NDPC)
Traffic-light rationale — AmberAutomated decision-making right is confirmed in force; biometric, genetic, AI-risk-assessment and surveillance-carveout specifics remain largely unconfirmed or emergent.

Sub-modules (6)

Profiling RestrictionsAmber

Profiling restrictions are addressed jointly with automated decision-making under Section 37 NDPA.

Claims (1):

  • Section 37 of the NDPA (Part VI) provides for protections in relation to automated decision-making.

Automated Decision Making TransparencyGreen

Section 37 (Part VI) of the NDPA addresses automated decision-making.

Claims (1):

  • Section 37 of the NDPA (Part VI) provides for protections in relation to automated decision-making.

Ai Risk AssessmentsRed

NDPC has begun exploratory AI-governance engagement (e.g., a National AI Scaling Hub partnership with Lagos Business School), but no binding AI-specific risk-assessment statute is confirmed in force.

Claims (1):

  • NDPC has partnered with Lagos Business School to establish a National Artificial Intelligence Scaling Hub, signalling emergent AI-governance engagement not yet codified as a binding risk-assessment requirement.

Biometric RegimeRed

No dedicated biometric-specific regime (facial recognition, fingerprint, gait) was confirmed distinct from general sensitive-personal-data treatment.

Genetic DataRed

No dedicated genetic-data-specific regime was confirmed distinct from general sensitive-personal-data treatment.

State Surveillance CarveoutsAmber

Constitutional exemptions (Sections 37 & 45, 1999 Constitution) are referenced generally in the GAID, but no detailed NDPA-specific surveillance carveout regime was confirmed.

Claims (1):

  • The GAID clarifies that nothing in the NDP Act or GAID authorises data processing without compliance with Sections 37 and 45 of the 1999 Constitution of the Federal Republic of Nigeria.
Category narrative97 words

The NDPA addresses automated decision-making under Section 37 (Part VI), giving data subjects protections analogous to GDPR Art 22. Biometric and genetic data likely fall within the Section 30 'sensitive personal data' category, though no dedicated biometric-specific regime (e.g., facial recognition governance) was confirmed. NDPC has begun engaging on AI governance, including a partnership with Lagos Business School on a national AI scaling hub, but no binding AI-specific risk-assessment statute was confirmed as in force. State-surveillance carveouts are referenced only generally via constitutional provisions (Sections 37 & 45, 1999 Constitution) rather than a detailed NDPA carveout regime.

Sources and claims (3)
  1. ProbableNational Assembly / hosted via DataGuidance — Section 37 of the NDPA (Part VI) provides for protections in relation to automated decision-making.observed
  2. SpeculativeNDPC — NDPC has partnered with Lagos Business School to establish a National Artificial Intelligence Scaling Hub, signalling emergent AI-governance engagement not yet codified as a binding risk-assessment requirement.observed
  3. ProbableNDPC — The GAID clarifies that nothing in the NDP Act or GAID authorises data processing without compliance with Sections 37 and 45 of the 1999 Constitution of the Federal Republic of Nigeria.observed