Protection of Personal Information Bill

A Bill establishes rules for protecting personal information collected by organizations in Nigeria. It targets individuals and data handlers like companies and government agencies. This aims to give people control over their personal data and prevent misuse.

Protection of Personal Information Bill Policy Overview

What Is This Policy?

A bill to strengthen and consolidate Nigeria's personal data protection framework, establishing comprehensive rights for individuals over their personal information and creating enforceable obligations for organisations that collect and process data.

Who Does It Target?

All individuals whose personal data is collected or processed in Nigeria Private sector companies, fintech, e-commerce, and telecommunications firms handling personal data Federal and state government agencies collecting citizen data Nigeria Data Protection Commission (NDPC) as the supervisory authority

What Does It Aim to Achieve?

Establish explicit, enforceable rights for Nigerians over their personal data (access, correction, deletion, portability) Impose stronger accountability obligations on data controllers and processors Align Nigeria's data protection law with GDPR-equivalent international standards to facilitate cross-border data flows Strengthen NDPC enforcement powers including administrative fines of up to 2% of global annual turnover

Key Features

Current Status

Funding: NDPC self-funding through administrative fines and registration fees

How to Access

Individuals exercise rights directly with data controllers; file complaints with NDPC. Requirements: Any individual whose data is being processed may submit a data request Requests submitted in writing (email acceptable) to the data controller Complaints to NDPC filed within 6 months of violation Application method: NDPC complaint portal: www.ndpc.gov.ng | Data requests to relevant organisation's Data Protection Officer

Important Terms

Data controllers must respond to access requests within 30 days Unlawful processing of personal data attracts fines up to 2% of annual global turnover Sensitive data (health, biometric, financial) requires explicit consent — implied consent is invalid

Impact & Metrics

Nigeria's digital economy generates vast quantities of personal data; stronger protections will build consumer trust and position Nigeria as a trusted data economy hub in Africa.

Official Resources

Website: www.ndpc.gov.ng Contact: Nigeria Data Protection Commission — [email protected] Federal Republic of Nigeria — Policy Summary Document | March 2026

Legal Framework

The Protection of Personal Information Bill, when enacted, would build on the Data Protection Act 2023 (NDPA), the Nigeria Data Protection Commission Act, and the 1999 Constitution (Section 37 — right to privacy). It aligns with the Evidence Act 2011 (electronic records), the Cybercrimes Act 2015, and international standards including the ECOWAS Supplementary Act on Personal Data Protection and the African Union Convention on Cyber Security and Personal Data Protection.