Controllers/processors domiciled, resident or operating in Nigeria; processing occurring in Nigeria; or processing of personal data of data subjects in Nigeria.
Key obligations
Lawful bases and principles (Part V); Registration of data controllers/processors of major importance with NDPC; DPIA where processing likely to result in high risk; NDPR 2019 continues as subsidiary framework
DPO required
Controllers of major importance must designate a DPO.
Registration
Yes: controllers/processors of major importance register with NDPC.
Cross-border transfers
Transfers require adequacy of protection or appropriate safeguards (Part VIII); consent/derogations otherwise.
Breach notification
Notify NDPC within 72 hours of becoming aware of a breach likely to cause harm; notify affected subjects.
Penalties
Controllers of major importance: up to the greater of NGN 10,000,000 and 2% of annual gross revenue; others: greater of NGN 2,000,000 and 2%.