Página traducida y verificada automáticamente. Prevalece la versión en inglés. Algunas partes siguen en inglés mientras se verifica su traducción. Ver en inglés · Informar un error de traducción
Regulaciones › Resto del mundo › Nigeria
NDPA (Nigeria)
Ley de Protección de Datos de Nigeria de 2023
CuándoPromulgada en junio de 2023
Quién la aplicaComisión de Protección de Datos de Nigeria (NDPC)
A quién se aplicaResponsables y encargados del tratamiento en Nigeria o que tratan datos de personas en Nigeria.
Informar al reguladorNotificar a la Comisión en un plazo de 72 horas desde que se tenga conocimiento de una violación que probablemente ponga en riesgo a las person…
DPO obligatorioLos responsables y encargados de gran importancia deben designar un DPO; umbrales bajos (más…
RegistroLos responsables y encargados de gran importancia deben registrarse, con tasas de N10,000-250,000 se…
Transferencias al extranjeroLas transferencias requieren un nivel adecuado de protección en el destino o una base prevista, como el co…
Plazo de solicitudesSin número fijo de días
Multa máximaEl mayor entre N10 millones o el 2% de los ingresos brutos anuales del año anterior para las entidades de gran importancia
52%
of Nigeria's 21 requirements are already met by European Union (GDPR). Here is what NDPA (Nigeria) adds, biggest gaps first.
Requisitos del DPOGobernanzaBig gap
GDPR1 DPO chosen for professional qualities, especially expert knowledge of data protection law and practice; no certification required.
NDPA (Nigeria) adds3 Expert knowledge required; NDPC keeps a database of certified DPOs with annual credential assessment, CPD points, and Commission-accredited DPOs signing DPIAs.
s.32(1); GAID Arts. 14, 28(4); CPD Guidance Notice (26 June 2026) · source ↗
RegistroGobernanzaBig gap
GDPR0 No general registration; controllers communicate DPO contact details to the supervisory authority.
NDPA (Nigeria) adds2 Controllers and processors of major importance must register, with fees of N10,000-250,000 by tier; ordinary-tier entities renew annually.
s.44; GAID Art. 9; Registration Guidance Notice (Feb 2024) · source ↗
ConservaciónGobernanzaBig gap
GDPR1 Storage limitation: keep identifiable data no longer than necessary; erase when no longer needed.
NDPA (Nigeria) adds3 Without a statutory period, storage must end within six months after the purpose is accomplished.
s.24(1)(d); GAID Art. 49(3)-(4) · source ↗
Alcance extraterritorialAlcance y base jurídicaGap
GDPR2 Applies to non-EU controllers offering goods or services to, or monitoring the behavior of, people in the EU.
NDPA (Nigeria) adds3 Applies to controllers and processors outside Nigeria processing personal data of data subjects in Nigeria.
s.2(2)(c) · source ↗
NiñosAlcance y base jurídicaGap
GDPR2 Parental consent required for information society services offered to children under 16; Member States may lower the age to no less than 13.
NDPA (Nigeria) adds3 Age 18 (Child's Rights Act). Parental or guardian consent with age verification; regulations pending for electronic services to children 13 and over.
s.31(1)-(5); s.65 · source ↗
MarketingDerechos de las personasGap
GDPR2 Absolute right to object to direct marketing; prior consent required for electronic marketing under the ePrivacy Directive, with a customer soft opt-in.
NDPA (Nigeria) adds3 Consent is required for any direct marketing; objection to direct marketing is absolute.
GAID Art. 18(1)(a); s.36(4) · source ↗
DPO obligatorioGobernanzaGap
GDPR1 DPO required for public bodies, large-scale systematic monitoring, or large-scale special-category or criminal data processing.
NDPA (Nigeria) adds2 Data controllers and processors of major importance must designate a DPO; low thresholds (over 200 data subjects in six months) capture many firms.
s.32(1); GAID Arts. 7(i), 11 · source ↗
DPIAGobernanzaGap
GDPR2 DPIA required before processing likely to result in high risk; prior consultation if residual high risk remains.
NDPA (Nigeria) adds3 DPIA required before high-risk processing; mandatory for listed cases such as profiling, sensitive data and cross-border transfers, and filed with the Commission.
s.28; GAID Art. 28(3), (5) · source ↗
Informar a las personasViolaciones de datosGap
GDPR2 Notify affected individuals without undue delay when the breach is likely to result in high risk.
NDPA (Nigeria) adds3 Notify affected data subjects immediately where high risk under the Act; GAID requires notice immediately after becoming aware.
s.40(3); GAID Art. 33(3) · source ↗
Responsabilidad penalAplicación de la leyGap
GDPR1 Member States set other penalties, including criminal penalties, for infringements not subject to administrative fines.
NDPA (Nigeria) adds2 Failing to comply with Commission orders is an offense with fines or up to one year in prison; principal officers are deemed culpable.
ss.49, 53 · source ↗
Already covered by GDPR: Lawful basis, Consent, Sensitive data, Rights, Request deadline, Records, Tell the regulator, Transfers abroad, Localization, Maximum fine, Private action.
A gap means NDPA (Nigeria) is more demanding than GDPR on that requirement, on our 0 to 3 scale (how we score). Read the cited section before acting. Not legal advice.
Biblioteca de regulaciones
Todas las leyes estatales de privacidad de EE. UU., en un mapa
24 estados tienen una ley integral de privacidad en la biblioteca, junto con las leyes de la UE, del Reino Unido, federales de EE. UU. y globales: 102 en total, cada una explicada en palabras sencillas con sus fuentes. Seleccione un estado para ver qué se aplica allí.
- En vigor
- Entrada en vigor
- Leyes sectoriales