Data Protection Monitor
Global Privacy & Data Protection Intelligence

Nigeria (NG) · Module Detail

Nigeria: Cross-Border & Adequacy

← Full Nigeria overview Build report with Nigeria Request deeper dive

#

Statutory transfer mechanism and adequacy-assessment framework are in force, but the practical adequacy list, SCC/BCR forms, and any localisation mandate remain unconfirmed/undeveloped from available sources.

Primary frameworkNigeria Data Protection Act, 2023 (NDPA), Part VIII
Supervisory authorityNigeria Data Protection Commission (NDPC)
Traffic-light rationale — AmberStatutory transfer mechanism and adequacy-assessment framework are in force, but the practical adequacy list, SCC/BCR forms, and any localisation mandate remain unconfirmed/undeveloped from available sources.

Sub-modules (6)

Transfer MechanismsAmber

Sections 41-43 address cross-border transfer; a Cross-Border Data Transfer Instrument must be submitted for Commission approval prior to transfer.

Claims (2):

  • Sections 41-43 (Part VIII) of the NDP Act address the transfer of personal data to a foreign country, requiring an adequate level of protection be ensured by the controller or processor.
  • A data controller or processor must submit a Cross-Border Data Transfer Instrument to the Commission for approval and obtain that approval before engaging in cross-border data transfer.

Adequacy ReceivedRed

No confirmed adequacy decision received by Nigeria from another regime was located.

Adequacy GrantedAmber

No confirmed list of countries granted adequacy status by the NDPC was located; the Commission assesses adequacy per Section 42 on a substantially-similar-principles basis.

Claims (1):

  • A level of protection is deemed adequate under Section 42 of the NDPA if it upholds principles substantially similar to the conditions for processing personal data under the Act.

Sccs And BcrsRed

No confirmed standard contractual clauses or binding corporate rules templates specific to NG were located.

Transfer Impact AssessmentAmber

No dedicated Transfer Impact Assessment requirement distinct from the Cross-Border Data Transfer Instrument process was confirmed.

Data LocalisationRed

No confirmed general data-localisation mandate was located for NG in this research pass.

Category narrative92 words

Part VIII (Sections 41-43) of the NDPA governs cross-border transfer of personal data, requiring an adequate level of protection at the destination, assessed by the Commission against principles 'substantially similar' to Nigeria's own standards (Section 42). Controllers/processors may also rely on derogations (e.g., contractual necessity, vital interest, data subject's sole benefit) or must submit a Cross-Border Data Transfer Instrument to the Commission for approval prior to transfer. No confirmed list of adequacy decisions received or granted by/to Nigeria, nor confirmed SCC/BCR templates or a data-localisation mandate, were identified in this research pass.

Sources and claims (3)
  1. ProbableNDPC — Sections 41-43 (Part VIII) of the NDP Act address the transfer of personal data to a foreign country, requiring an adequate level of protection be ensured by the controller or processor.observed
  2. ProbableNDPC — A data controller or processor must submit a Cross-Border Data Transfer Instrument to the Commission for approval and obtain that approval before engaging in cross-border data transfer.observed
  3. ProbableOneTrust DataGuidance — A level of protection is deemed adequate under Section 42 of the NDPA if it upholds principles substantially similar to the conditions for processing personal data under the Act.observed