#
Core lawful-basis and consent framework is in force, but detailed sub-regulatory guidance on special categories, pseudonymisation/anonymisation safe-harbours and precise child-consent mechanics is not yet confirmed as published.
Primary frameworkNigeria Data Protection Act, 2023 (NDPA), Part V
Supervisory authorityNigeria Data Protection Commission (NDPC)
Traffic-light rationale — AmberCore lawful-basis and consent framework is in force, but detailed sub-regulatory guidance on special categories, pseudonymisation/anonymisation safe-harbours and precise child-consent mechanics is not yet confirmed as published.
Sub-modules (4)
Lawful BasesGreen
Lawful bases include consent, legal obligation, contract, vital interest, and public interest.
Claims (1):
- NDPC relies on and recognises lawful bases for data processing such as consent, legal obligation and contract, consistent with NDPA Part V provisions on lawful basis of personal data processing.
Consent ThresholdsGreen
Consent must be evidenced in writing, orally, electronically, or through other action demonstrating the data subject's knowledge and agreement.
Claims (1):
- A data controller must seek consent either in writing, orally, through electronic means or by any other action through which the data subject knows he is giving consent.
Special CategoriesAmber
Sensitive personal data is addressed under Section 30 NDPA; GAID Article 28(8) imposes DPIA obligations for software processing sensitive data.
Claims (1):
- A data controller or processor that deploys software for processing sensitive personal data must carry out a DPIA and submit it to the Commission within four months, per GAID Article 28(8).
Pseudonymisation And AnonymisationRed
No specific pseudonymisation/anonymisation safe-harbour provisions were located in this research pass.
Category narrative89 words
Sources and claims (4)
- ProbableNDPC — NDPC relies on and recognises lawful bases for data processing such as consent, legal obligation and contract, consistent with NDPA Part V provisions on lawful basis of personal data processing.observed
- ProbableNDPC — A data controller must seek consent either in writing, orally, through electronic means or by any other action through which the data subject knows he is giving consent.observed
- ProbableNDPC — A data controller or processor that deploys software for processing sensitive personal data must carry out a DPIA and submit it to the Commission within four months, per GAID Article 28(8).observed
- UncertainNDPC — No confirmed statutory or GAID-level pseudonymisation/anonymisation safe-harbour definitions were identified for NG in this research pass.observed