THE PROTECTION OF PERSONAL AND SENSITIVE DATA UNDER NIGERIAN LAW AND INTERNATIONAL REGULATIONS
Introduction
The increasing reliance on technology has made the collection and processing of personal data an integral part of modern commercial, professional and governmental activities. Organisations collect names, contact details, identification numbers, photographs, employment records and other information relating to individuals. While the use of personal data facilitates commercial and administrative activities, it also creates significant risks where such information is collected, used, disclosed or retained without adequate safeguards.
Personal data in Nigeria is principally governed by the Nigeria Data Protection Act 2023 (NDPA), which established the Nigeria Data Protection Commission (NDPC) as the regulatory authority for data protection in Nigeria.
The protection of personal data is constitutionally relevant as Section 37 of the Constitution of the Federal Republic of Nigeria 1999 (as amended) guarantees the privacy of citizens. Nigerian courts have considered the relationship between this constitutional right to privacy and the protection of personal information.
Personal Data and the Principle of Lawful Processing
The NDPA adopts a broad definition of personal data, encompassing information relating to an identifiable person. Accordingly, the fact that information such as a person’s name, telephone number or email address is publicly accessible does not, without more, take such information outside the protection afforded by data protection law. Where such information relates to an identifiable individual, its collection, use, disclosure or other processing may attract the obligations imposed by the NDPA.
Section 24 of the NDPA sets out the principles governing the processing of personal data. Personal data must be processed fairly, lawfully and transparently; collected for specified and legitimate purposes; relevant and limited to what is necessary; and where necessary, kept up to date; and protected against unauthorised or unlawful processing, loss, destruction or damage. The data controller must also be able to demonstrate compliance with these principles.
For example, in the context of voter registration, the Independent National Electoral Commission (INEC) may require information such as a person’s name, date of birth, photograph and other identification details necessary to establish eligibility and identity. It would, however, be difficult to justify collecting unrelated information, such as a voter’s medical history, where such information has no connection with the purpose of voter registration.
This same principle applies across other sectors; an organisation cannot collect information merely because it may potentially be useful in the future. There must be a legitimate purpose for the processing and the information collected must be proportionate to that purpose. This is the essence of purpose limitation and data minimisation.
The Court of Appeal’s decision in Incorporated Trustees of Digital Rights Lawyers Initiative & Ors v. NIMC (2021) LPELR-55623(CA) is instructive on the relationship between personal information and the constitutional right to privacy. The Court maintained that there is an intersection between personal data and breach of right to privacy as protected under section 37 of the Constitution particularly where such data contains information capable of identifying or revealing private details about an individual.
Omotayo v. Airtel Networks Ltd (2025) LPELR-80012(CA), the Court of Appeal considered allegations concerning the failure of a telecommunications service provider to deal with a customer’s data with reasonable diligence. The case illustrates the continuing relevance of privacy and data-handling obligations in the telecommunications sector and demonstrates that organisations entrusted with customers’ information may face legal consequences where their handling of such information is challenged.
Sensitive Personal Data and Enhanced Protection
The law recognises that not all personal information presents the same level of risk. Section 30 of the NDPA provides specific protection for sensitive personal data, including genetic and biometric data used for unique identification, race or ethnic origin, religious or similar beliefs, health status, political opinions or affiliations. The rationale for this distinction is that the misuse of medical information, biometric data, religious beliefs or political affiliations may expose an individual to consequences far more serious than the ordinary inconvenience associated with the disclosure of basic contact information.
The classification of information as sensitive personal data does not amount to an absolute prohibition against processing. Rather, it imposes additional requirements and safeguards. Section 30 of the NDPA states circumstances in which sensitive personal data may lawfully be processed, including specified circumstances relating to consent, employment, medical purposes, and research, subject to the statutory requirements.
Data Security and Breach Management
The obligations of a data controller or processor do not end with establishing a lawful basis for processing personal data. The organisation must also ensure that the data in its custody is properly protected. Section 29 of the NDPA requires controllers and processors to comply with the provisions of the Act, while section 39 requires appropriate technical and organisational measures to safeguard personal data against unauthorised access, loss, destruction or other forms of misuse. Where a data breach occurs, section 40 imposes further obligations for managing and reporting the breach. An organisation must not only have a lawful reason for collecting personal data but must also take reasonable steps to keep the information secure and respond appropriately where it is compromised.
Where a proposed processing of personal data is likely to pose a high risk to the rights and freedoms of individuals, section 28 of the NDPA requires the organisation to conduct a Data Protection Impact Assessment.
This requirement is particularly relevant where an organisation intends to process sensitive personal data, biometric or health information, or information which, if misused, could cause significant harm to the individual concerned. The purpose is to ensure that privacy risks are considered and addressed before, rather than after, the processing takes place.
Cross-Border Processing and International Regulations
As a result of international nature of modern commerce, personal data is frequently transferred across jurisdictions. Nigerian organisations may use foreign cloud service providers, transfer employee information to an overseas parent company or engage foreign service providers to process personal data.
Sections 41–43 of the NDPA regulate the transfer of personal data outside Nigeria and provide mechanisms through which such transfers may lawfully occur. The position is broadly comparable with the General Data Protection Regulation (GDPR) of the European Union. Article 5(1) of GDPR requires personal data to be processed
“lawfully, fairly and in a transparent manner”, collected for “specified, explicit and legitimate purposes” and limited to what is necessary for those purposes.
Article 9 provides enhanced protection for special categories of personal data, including biometric data, health information, religious beliefs, political opinions, etc. It provides that the processing of such data “shall be prohibited” except in specified circumstances, including explicit consent, healthcare, employment and substantial public interest.
The NDPA provides enhanced protection for sensitive personal data under section 30, however there is an important distinction in terminology. The NDPA refers to “sensitive personal data”, while the GDPR uses the expression “special categories of personal data.” The two concepts are comparable in their recognition of the heightened risks associated with certain categories of information, although the regimes are separate legal frameworks and the GDPR does not automatically apply merely because an organisation operates in Nigeria.
Its application may nevertheless become relevant where a Nigerian organisation processes the personal data of individuals within the European Union or otherwise falls within the territorial scope of the GDPR.
Implications of the NDPA on Organisations
There is a need for data protection to be approached as an aspect of corporate governance and risk management rather than as a matter of merely preparing a privacy policy.
Organisations should identify the categories of personal data they collect, determine the purposes for which the information is processed, establish the applicable lawful basis, limit collection to what is necessary, regulate access and disclosure, maintain appropriate security measures and establish procedures for dealing with data breaches and data subject requests.
Particular attention should be paid to sensitive personal data. Where an organisation processes health, biometric, genetic, financial or other high-risk information, the consequences of inadequate controls may be significantly greater. Organisations should therefore adopt appropriate contractual, technical and organisational safeguards and ensure that employees and third-party processors understand their respective obligations.
This is especially relevant to professional service providers, including law firms. Legal practitioners routinely receive identification documents, financial records, medical information, employment records and information relating to litigation and commercial transactions. The professional duty of confidentiality does not displace statutory data protection obligations. Rather, confidentiality, data security, controlled access, appropriate retention and lawful processing should operate together as part of a firm’s overall information governance framework.
Conclusion
The NDPA 2023 has moved the protection of personal data in Nigeria from a largely regulatory and policy based framework to a comprehensive statutory regime backed by an independent regulatory authority, enforceable rights and specific compliance obligations.
The central principle is that personal data must be processed for legitimate and specified purposes and in a manner proportionate to those purposes. Sensitive personal data attracts additional safeguards because of the potentially greater consequences of misuse.
Accordingly, compliance cannot be reduced to obtaining consent from data subjects or publishing a privacy policy. A compliant organisation must be able to demonstrate why information is collected, the lawful basis for its processing, the measures adopted to protect it, the persons who have access to it and the circumstances in which it may be disclosed or transferred.
As Nigerian businesses increasingly operate within a global digital economy, effective data protection will continue to be both a legal requirement and an important component of responsible corporate governance.
Franklyn C. Chukwunenye, Esq.
Associate, Technology, Media & Telecommunication (TMT)
Oluwaseye Olanrewaju, Esq.
Associate, Technology, Media & Telecommunications (TMT) Law