Recently sworn-in President of Nigeria, Bola Ahmed Tinubu, has on Wednesday officially signed the Nigeria Data Protection Bill 2023 into law.
The law, which establishes a new data protection body and regulatory framework for data protection in the country, aims to address the problematic issue of data protection in Nigeria, where personal data is often collected without sufficient safeguards.
Despite the frequent denial by organisations, it is no doubt that data breaches have become increasingly common in the country. The new law seeks to establish a robust framework for safeguarding personal information and preventing unauthorized access to these information.
The key provision of the law is the establishment of the Nigeria Data Protection Commission, replacing the previous Nigeria Data Protection Bureau. The commission will be led by a National Commissioner appointed by the President for a four-year term, with the possibility of renewal.
The commission’s powers include issuing regulations, rules, directives, and guidance, engaging consultants for assistance, imposing penalties, and prescribing fees payable by data controllers and processors. It also specifies the filing requirements and content of compliance returns by data controllers and processors.
Additionally, the law mandates the creation of a Governing Council chaired by a retired judge, with other members appointed by the President on a part-time basis. The council’s role is to support the commission in its functions.
The law outlines principles for the processing of personal data, emphasizing the legitimate collection and processing of data with appropriate security measures. It establishes the lawful basis for personal data processing, which is based on the consent of the data subject for specific purposes. The law also grants certain rights to data subjects and prohibits the cross-border transfer of personal data unless there is legal backing. Furthermore, it requires all data controllers and processors of significant importance to register with the commission within six months of the law’s commencement.
The Bill saw its initial development by the Nigeria Data Protection Bureau in October 2022 and received approval from the Federal Executive Council in January 2023. It was then transmitted to the National Assembly by President Muhammadu Buhari in April 2023. The bill passed its third reading in the Nigerian Senate in May 2023 and was subsequently sent to the House of Representatives for consideration.
