Overview of the Nigeria Data Protection Act 2023
The Nigeria Data Protection Act 2023 marks a significant advancement in regulating automated decision-making systems, including artificial intelligence (AI), within Africa’s largest economy. Enacted on June 12, 2023, the law introduces provisions that align with global standards such as the General Data Protection Regulation (GDPR), particularly in restricting decisions made solely through automated processes without human oversight. This legislative framework also imposes revenue-based administrative fines for non-compliance, reinforcing accountability among organizations operating within Nigeria’s digital ecosystem.
The NDPC’s mandate stems from the Nigeria Data Protection Regulation (NDPR) of 2019, which was issued by the National Information Technology Development Agency (NITDA) as subsidiary legislation under the NITDA Act of 2007. While the NDPR provided an initial regulatory foundation, the 2023 Act strengthens these provisions by explicitly addressing AI-driven decision-making and expanding enforcement mechanisms.
Despite the introduction of this comprehensive data protection law, Nigeria’s broader national AI strategy remains non-binding. This creates a dual regulatory environment where AI systems must comply with data protection requirements under the 2023 Act while operating within the broader, less prescriptive guidelines of the national AI strategy. The absence of binding AI-specific regulations means that organizations must rely primarily on the data protection framework to ensure ethical and transparent AI deployment.
Key Provisions of the Nigeria Data Protection Act 2023
The 2023 Act introduces critical protections against automated decision-making, a provision directly inspired by GDPR’s Article 22. Under this framework, individuals have the right to challenge decisions made solely by automated processing, including AI systems, where such decisions produce legal or similarly significant effects. Organizations must provide a means for affected individuals to request human review of automated decisions, thereby balancing efficiency with fairness.
This revenue-based penalty system is designed to deter non-compliance while remaining proportionate to an entity’s financial capacity. The NDPC is empowered to investigate and impose these fines, ensuring consistent enforcement across sectors.
The Act also establishes the role of Data Protection Compliance Organizations (DPCOs), which are entities licensed by the NDPC to provide training, auditing, consulting, and compliance services related to data protection laws. DPCOs can include professional service firms, consultancies, IT service providers, audit firms, or law firms, all of which must meet licensing criteria set by the NDPC.
Enforcement and Regulatory Framework
The NDPC plays a central role in enforcing the Nigeria Data Protection Act 2023, with its activities extending beyond mere oversight to active investigation and public advocacy. Since its establishment in 2022, the NDPC has engaged in high-profile initiatives, such as partnering with organizations like the Voice of Nigeria (VON) in February 2023 to promote data protection awareness in the context of the Fourth Industrial Revolution (4IR). These collaborations emphasize capacity building, particularly for staff working with emerging technologies, to ensure that Nigeria’s workforce can adapt to evolving digital challenges. The NDPC’s proactive approach includes investigations into alleged privacy breaches, as seen in its 2024 probe into the National Identity Management Commission (NIMC), demonstrating its commitment to holding public and private entities accountable.
The NDPC’s enforcement powers are underpinned by its authority to conduct audits, issue compliance notices, and impose fines. Its regulatory scope covers all sectors, including finance, healthcare, and technology, where automated decision-making and AI applications are prevalent.
While the 2023 Act provides a strong foundation for regulating AI and automated systems, its effectiveness depends on continuous collaboration between the NDPC, private sector stakeholders, and international bodies. The absence of a binding national AI strategy means that organizations must navigate a landscape where data protection laws serve as the primary guardrails for AI ethics and transparency.
Required actions
- Section 37: individuals have the right not to be subject to decisions based solely on automated processing with legal or similarly significant effects - Data controllers of major importance must register with the Commission and appoint a DPO; conduct DPIAs for high-risk processing