Introduction
Nigerian companies (that process individual data over a certain
threshold) are now required to comply with data protection and
privacy rules as a legal obligation as opposed to best practice.
Unlike other preexisting data protection compliance requirements,
which were specific to companies operating within certain sectors,
this new legal requirement cuts across all sectors.
Given the attendant increase in the use and transfer of personal
information of individuals and the need to protect the individual
right to privacy, the National Information Technology Development
Agency (NITDA) of Nigeria issued the Nigeria Data Protection
Regulation (NDPR) in January 2019. The NDPR introduces major
compliance obligations for Nigerian companies, which include audit
checks, publication of data protection policies, filing of audit
reports amongst others and also stipulates stiff penalties for its
breach.
