---
title: "Nigeria — Cross-Border & Adequacy | Data Protection Monitor"
canonical: https://dataprotection.gi/jurisdictions/nigeria/cross-border-and-adequacy/
source_html: /jurisdictions/nigeria/cross-border-and-adequacy/index.html
description: "Nigeria — Cross-Border & Adequacy: cross_border_and_adequacy Cross-Border & Adequacy 6 sub-modules 3 claims Amber ▾ # Statutory transfer mechanism and adequacy-assessment framework are in force, but the practical ad"
generated_at: 2026-10-25T04:46:50Z
content_sha256: 7d098c216e1d455963c394ad49c2f080ec557cb0c7a7a2815614c1b052e51aa4
generator: "fe-fleet/md-twin@1.0"
---
# Nigeria — Cross-Border & Adequacy | Data Protection Monitor

### D5Cross-Border & Adequacy6 sub-modules3 claimsAmber▾#

Statutory transfer mechanism and adequacy-assessment framework are in force, but the practical adequacy list, SCC/BCR forms, and any localisation mandate remain unconfirmed/undeveloped from available sources.

Primary framework Nigeria Data Protection Act, 2023 (NDPA), Part VIII

Supervisory authority [Nigeria Data Protection Commission (NDPC)](https://ndpc.gov.ng/)

Traffic-light rationale — Amber Statutory transfer mechanism and adequacy-assessment framework are in force, but the practical adequacy list, SCC/BCR forms, and any localisation mandate remain unconfirmed/undeveloped from available sources.

#### Sub-modules (6)

#### Transfer MechanismsAmber

Sections 41-43 address cross-border transfer; a Cross-Border Data Transfer Instrument must be submitted for Commission approval prior to transfer.

Claims (2):

- Sections 41-43 (Part VIII) of the NDP Act address the transfer of personal data to a foreign country, requiring an adequate level of protection be ensured by the controller or processor.
- A data controller or processor must submit a Cross-Border Data Transfer Instrument to the Commission for approval and obtain that approval before engaging in cross-border data transfer.

#### Adequacy ReceivedRed

No confirmed adequacy decision received by Nigeria from another regime was located.

#### Adequacy GrantedAmber

No confirmed list of countries granted adequacy status by the NDPC was located; the Commission assesses adequacy per Section 42 on a substantially-similar-principles basis.

Claims (1):

- A level of protection is deemed adequate under Section 42 of the NDPA if it upholds principles substantially similar to the conditions for processing personal data under the Act.

#### Sccs And BcrsRed

No confirmed standard contractual clauses or binding corporate rules templates specific to NG were located.

#### Transfer Impact AssessmentAmber

No dedicated Transfer Impact Assessment requirement distinct from the Cross-Border Data Transfer Instrument process was confirmed.

#### Data LocalisationRed

No confirmed general data-localisation mandate was located for NG in this research pass.

Category narrative 92 words

Part VIII (Sections 41-43) of the NDPA governs cross-border transfer of personal data, requiring an adequate level of protection at the destination, assessed by the Commission against principles 'substantially similar' to Nigeria's own standards (Section 42). Controllers/processors may also rely on derogations (e.g., contractual necessity, vital interest, data subject's sole benefit) or must submit a Cross-Border Data Transfer Instrument to the Commission for approval prior to transfer. No confirmed list of adequacy decisions received or granted by/to Nigeria, nor confirmed SCC/BCR templates or a data-localisation mandate, were identified in this research pass.

Evidence 3

Sources and claims (3)
- Probable[NDPC](https://ndpc.gov.ng/wp-content/uploads/2025/07/Updated-Guidance-Notice-on-Registtration-2024.pdf) — Sections 41-43 (Part VIII) of the NDP Act address the transfer of personal data to a foreign country, requiring an adequate level of protection be ensured by the controller or processor.observed 2026-08-07
- Probable[NDPC](https://ndpc.gov.ng/faqs/) — A data controller or processor must submit a Cross-Border Data Transfer Instrument to the Commission for approval and obtain that approval before engaging in cross-border data transfer.observed 2026-08-07
- Probable[OneTrust DataGuidance](https://www.dataguidance.com/sites/default/files/data_protection_act_2023.pdf) — A level of protection is deemed adequate under Section 42 of the NDPA if it upholds principles substantially similar to the conditions for processing personal data under the Act.observed 2026-08-07