Introduction: The Path of Data Across
Borders
Today, personal data doesn't stay in one place. It
moves—fast and often—across countries. Each transfer
brings new legal responsibilities for businesses that handle such
data.
Imagine Amina, a Nigerian professional. Her day starts under
Nigeria's Data Protection Act (NDPA), which governs how her
data should be collected, stored, and shared. But the moment she
orders shoes from a UK-based store, her personal
details—name, address, payment information—are
processed under the EU's General Data Protection Regulation
(GDPR). Later, she uploads a file to a U.S.-based cloud provider,
with the data stored in Germany and Japan. That file may still be
subject to U.S. laws like the CLOUD Act, which gives American
authorities access under specific conditions. At night, she
video-calls a colleague in Kenya and posts a photo
online—further extending her digital footprint across
multiple jurisdictions.
