Nigeria Data Protection Regulation (NDPR 2019) + Nigeria Data Protection Act 2023: AI Compliance Requirements

NDPA 2023 Section 25 requires a documented lawful basis for all personal data processing: consent, contract, legal obligation, vital interests, public interest, or legitimate interest. AI systems processing Nigerian residents' data must document their basis prior to processing. Consent must be freely given, specific, informed, and unambiguous — pre-ticked boxes and bundled consent are prohibited.

NDPA 2023 Sections 34-43 grant Nigerian residents rights to access, rectify, erase, restrict, and port their personal data. AI automated decision-making must be disclosed and human review provided on request. Data controllers must respond within 30 days. A designated Data Protection Officer (DPO) is required for high-risk processing.

NDPR 2019 (and transitional NDPA 2023 obligations) require organizations processing data of more than 1,000 Nigerian individuals to submit an annual data audit report to the NDPC before 15 March each year. The report must cover categories of data processed, security measures, breach incidents, and AI-specific processing activities.

NDPA 2023 Section 43 restricts transfer of Nigerian personal data outside Nigeria to countries with an adequate level of data protection or with NDPC-approved transfer mechanisms (BCRs, standard contractual clauses). Cloud AI services processing Nigerian data must document transfer controls and maintain records available for NDPC inspection.