Data Protection Monitor
Global Privacy & Data Protection Intelligence

Nigeria (NG) · Module Detail

Nigeria: Controller/Processor Duties

← Full Nigeria overview Build report with Nigeria Request deeper dive

#

Core accountability, DPIA, DPO, breach-notification and audit-filing obligations are confirmed in force and actively administered via NDPC's registration and DPCO ecosystem.

Primary frameworkNigeria Data Protection Act, 2023 (NDPA), Parts V & VII; GAID 2025
Supervisory authorityNigeria Data Protection Commission (NDPC)
Traffic-light rationale — GreenCore accountability, DPIA, DPO, breach-notification and audit-filing obligations are confirmed in force and actively administered via NDPC's registration and DPCO ecosystem.

Sub-modules (7)

Accountability And DpiaGreen

DPIA obligations under Section 28 NDPA and GAID Article 28(3)/(8), including a 4-month submission window for sensitive-data-processing software DPIAs.

Claims (1):

  • A data controller or data processor who deploys software for processing of sensitive personal data must carry out a DPIA and submit same to the Commission within four months, per GAID Article 28(8).

Dpo RequirementsGreen

Section 32 NDPA requires Data Protection Officers; GAID sets DPO reporting duties on compliance status.

Claims (1):

  • Section 32 of the NDPA (Part V) provides for the appointment of Data Protection Officers, with GAID requiring DPO reports to include the compliance status of the data controller or processor.

Ropa RequirementsAmber

No dedicated Records of Processing Activities (ROPA) provision was separately confirmed; likely embedded within general accountability/registration obligations.

Joint Controller ArrangementsGreen

Section 29(1)(a) requires controllers engaging processors to ensure processor compliance with applicable principles/obligations; joint and vicarious liability applies to corporate officers and agents.

Claims (2):

  • Under Section 29(1)(a) of the NDPA, where a data controller or processor engages another processor, it must ensure the engaged processor complies with the principles and obligations applicable to the controller.
  • Where an offence has been committed by a body corporate or firm, principal officers are deemed culpable unless they prove the offence occurred without their consent/connivance and they exercised diligence to prevent it; controllers/processors are vicariously liable for acts of agents or employees.

Security MeasuresAmber

Part VII of the NDPA (Section 39) addresses security, integrity and confidentiality of processing.

Claims (1):

  • Part VII of the NDPA (Section 39, 'Security, integrity, and confidentiality') establishes security-of-processing obligations for controllers and processors.

Breach NotificationGreen

72-hour breach notification to the Commission required under Section 40(2); processor-to-controller notification obligations under Section 40(1).

Claims (2):

  • A data controller shall, within 72 hours of becoming aware of a breach likely to result in a risk to the rights and freedoms of individuals, notify the Commission of the breach, describing its nature including categories and approximate numbers of data subjects and records concerned.
  • Where a breach occurs with respect to data being processed by a data processor, the processor shall, on becoming aware of the breach, notify the engaging data controller/processor describing the nature of the breach and respond to information requests.

Retention And DisposalRed

No confirmed statutory retention-period or disposal-duty provisions were located in this research pass.

Category narrative103 words

The NDPA imposes accountability obligations including DPIAs (Section 28; GAID Article 28), DPO appointment (Section 32), and a 72-hour breach notification duty to the Commission for controllers (Section 40(2)), with processors required to notify controllers 'on becoming aware' of a breach (Section 40(1)). Data Protection Compliance Organisations (DPCOs) are licensed under Section 33 to provide compliance verification services. Annual Compliance Audit Returns (CAR) must be filed before 31 March each year via a licensed DPCO. Joint and vicarious liability for corporate officers and agents/employees is established under the Act's enforcement provisions. Explicit statutory retention/disposal duration limits were not confirmed in the sources reviewed.

no periodic updates on record for this sub-brief

Sources and claims (9)
  1. ProbableNDPC — A data controller or data processor who deploys software for processing of sensitive personal data must carry out a DPIA and submit same to the Commission within four months, per GAID Article 28(8).observed
  2. ProbableNDPC — Section 32 of the NDPA (Part V) provides for the appointment of Data Protection Officers, with GAID requiring DPO reports to include the compliance status of the data controller or processor.observed
  3. ProbableNDPC — Under Section 29(1)(a) of the NDPA, where a data controller or processor engages another processor, it must ensure the engaged processor complies with the principles and obligations applicable to the controller.observed
  4. ProbableNational Assembly / hosted via DataGuidance — Where an offence has been committed by a body corporate or firm, principal officers are deemed culpable unless they prove the offence occurred without their consent/connivance and they exercised diligence to prevent it; controllers/processors are vicariously liable for acts of agents or employees.observed
  5. ProbableNational Assembly / hosted via DataGuidance — Part VII of the NDPA (Section 39, 'Security, integrity, and confidentiality') establishes security-of-processing obligations for controllers and processors.observed
  6. ProbableNDPC — A data controller shall, within 72 hours of becoming aware of a breach likely to result in a risk to the rights and freedoms of individuals, notify the Commission of the breach, describing its nature including categories and approximate numbers of data subjects and records concerned.observed
  7. ProbableOneTrust DataGuidance — Where a breach occurs with respect to data being processed by a data processor, the processor shall, on becoming aware of the breach, notify the engaging data controller/processor describing the nature of the breach and respond to information requests.observed
  8. ProbableNDPC — Data controllers are expected to file annual Compliance Audit Returns (CAR) before 31 March each year, per GAID Articles 10.7 and 10.8, as a practical accountability/record-keeping mechanism.observed
  9. UncertainNDPC — No confirmed statutory retention-period or disposal-duty provision was located for NG in this research pass.observed