Nigeria: Data Protection

The Nigeria Data Protection Commission's controversial Guidance Notice requiring registration of Data Controllers and Processors of Major Importance sparked legal challenges and widespread debate over regulatory authority, privacy rights, and compliance obligations. A landmark Federal High Court ruling has now clarified the scope and validity of these registration requirements, establishing binding precedent on who must register and under what circumstances.

Nigeria's adoption of AI-powered facial recognition at major airports and automated credit scoring by digital lenders raises urgent questions about constitutional privacy protections. With Section 37 of the 1999 Constitution drafted before modern biometric surveillance existed, can its guarantee of privacy extend to algorithmic profiling and mass data collection?

When Nigerian Breweries used crowd footage from a sponsored event in its advertising campaign, it triggered a landmark data protection ruling. The Lagos High Court determined that identifiable photographs constitute personal data under Nigeria's 2023 Data Protection Act, and that generic venue notices cannot authorize commercial use of attendees' images.

Religious leaders routinely receive sensitive personal disclosures during spiritual counselling, creating expectations of confidentiality rooted in faith traditions and pastoral trust. Yet the legal landscape presents a complex web of competing obligations, from safeguarding laws and mandatory reporting requirements to data protection regulations and criminal investigations. This analysis examines how clergy must balance their religious duty of confidentiality against evolving legal obligations that may com

The Irish High Court's landmark 2026 ruling against TikTok has exposed a critical vulnerability in how multinational tech companies handle cross-border data transfers. By establishing that data access location matters more than storage location, this judgment carries profound implications for Nigeria's digital economy and the enforcement powers of the Nigeria Data Protection Commission under the NDPA 2023.

In a landmark Federal High Court ruling, GTCO has been ordered to stop sending unsolicited marketing messages to non-customers, marking a decisive shift in Nigeria's data protection enforcement landscape. The judgment establishes that companies can no longer exploit personal data without demonstrable legal basis, reinforcing that direct marketing requires valid consent under the Nigeria Data Protection Act 2023.

Nigeria's Data Protection Commission is reviewing the NDPA 2023 to directly regulate artificial intelligence, robotics, and big data—marking a pivotal shift from vague references to "emerging technologies" toward explicit AI governance.

As artificial intelligence becomes deeply embedded in Nigerian business operations—from financial services to creative industries—fundamental questions emerge about who owns the underlying AI systems...

Nigeria has emerged as a critical hub for venture capital and corporate expansion in Sub-Saharan Africa, yet success hinges on understanding the complex regulatory framework introduced by CAMA 2020...