Nigeria’s Data Protection Act, 2023

A data controller shall bear the burden of proof for establishing a data subject’s consent and silence or inactivity of the data subject does not constitute consent.

Data controllers and data processors of major importance must register with the Commission within 6 months of the DPA’s commencement or on becoming a data controller or data processor of major importance. A ‘data controller or data processor of major importance’ in Nigeria refers to an entity domiciled, resident, or operating in Nigeria that processes or intends to process data for a large number of Nigerian data subjects (as prescribed by the Commission) or processes data vital to Nigeria's economy, society, or security (as designated by the Commission).

Upon discovering a personal data breach, a data controller must immediately inform the data controller or the engaging data processor, detailing the nature of the breach and providing an approximate number of affected data subjects and personal data records.

When a data controller identifies a personal data breach likely to harm individuals' rights, they must notify the Commission within 72 hours of becoming aware of the breach, detailing its nature and providing an approximate number of affected data subjects and personal data records.

A data subject aggrieved by the decision, action, or inaction of a data controller or data processor that violates the DPA, or its subsidiary legislation, may lodge a complaint with the Commission. If dissatisfied with an order of the Commission, they may seek judicial review in the appropriate court within 30 days of the order.

The Commission can impose fines if a data controller or processor violates the DPA or its subsidiary legislation. For data controllers or data processors of major importance, the fine can be up to the greater of NGN 10 million or 2% of their preceding financial year's annual gross revenue from Nigeria, while for other data controllers or processors, the fine can be up to the greater of NGN 2 million or 2% of their preceding financial year's annual gross revenue from Nigeria.

A data subject, who suffers injury, loss, or harm as a result of a violation of the DPA by a data controller or data processor, may recover damages by way of civil proceedings in the appropriate court.