Nigeria

NDPC established as independent regulator with enforcement powers.

Consent must be obtained for processing. Six lawful bases similar to GDPR.

Rights to access, rectification, erasure, restriction, portability, and objection.

Transfers to adequate countries, with appropriate safeguards, or consent.

Must notify NDPC and affected data subjects of personal data breaches.

DPO required for organisations processing data of more than a prescribed number.

Parental consent required for children. Specific age threshold to be defined in regulations.

Penalty framework established. Enforcement mechanisms still being operationalised.

CBN data requirements, NCC telecom rules, NHIA health data guidelines.

No specific cookie regulation.

No specific provisions on automated decisions.

Some sector-specific localisation for financial data and government data.

Major data controllers have additional obligations including annual audit requirements.

NDPA applies to government processing with exemptions for national security.