Nigeria Data Protection Act, 2023, rights of a data subject

Nigeria Data Protection Act, 2023, rights of a data subject (ss. 27 and 46; GAID 2025, arts. 27 and 36-40)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 12 June 2023.

A data subject rights rule binding public and private bodies.

As of 19 September 2026.

What it requires

Give a data subject the right not to be subject to a decision based solely on automated processes or algorithms, and give effect to their rights to rectification, data portability, erasure, and lodging a complaint with the Commission.
Give a data subject an effective opportunity to rectify their personal data on the platform you process it through, without requiring an affidavit or a newspaper publication where the correction aligns the data with their National Identification Number, and without charging them for an error that was not their fault.
Give effect to the right to data portability where the data subject supplied the personal data on the basis of consent or where the processing is necessary to perform a contract, without prejudice to the rights of other data subjects whose data is in the same set.
Erase personal data on request where it is no longer necessary for its original purpose, where consent was the lawful basis and has been withdrawn, where the data subject objects to processing founded on legitimate interest and no overriding ground exists, where it is processed for direct marketing and the data subject objects, where it was processed unlawfully, or where a legal ruling or obligation requires erasure.
Carry a clause on the right to lodge a complaint with the Commission in every regulation, policy, framework or legal instrument of yours that pertains to processing personal data, and answer a Standard Notice to Address Grievance a data subject serves on you.
Give a data subject the information section 27 of the Act requires in clear terms, taking their circumstances into account.

What it reaches

Obligation class

Data subject rights, Disclosure

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Article 27 requires the information given to a data subject under section 27 of the Act to be clear and to take the data subject's circumstances into account.

Article 36 makes the right to rectification part of the accuracy principle, requires the platform through which personal data is processed to give an effective opportunity to rectify, bars requiring an affidavit or a newspaper publication where the correction aligns the data with the data subject's National Identification Number, and bars charging a data subject to correct an error that was not their fault.

Article 37 gives a right to data portability where the data subject supplied the personal data on the basis of consent or where the processing is necessary to perform a contract, without prejudice to the rights of other data subjects in the same set or to the right of erasure.

Article 38 gives a right to be forgotten where the data is no longer necessary for the purpose it was collected for, where consent is withdrawn and was the lawful basis, where the data subject objects to processing founded on legitimate interest and no overriding ground exists, where the processing is for direct marketing and the data subject objects, where the processing was unlawful, or where erasure is needed to comply with a legal ruling or obligation.

Article 39 makes the right to lodge a complaint with the Commission a threshold right of redress under section 37 of the 1999 Constitution and section 46 of the Act, and requires every instrument about processing personal data to carry a clause on it. Article 40 provides the Standard Notice to Address Grievance in Schedule 9, which an aggrieved data subject may serve directly on a controller or processor without it being a condition of complaining to the Commission.

Article 43(2)(a) carries the right of a data subject not to be subject to a decision solely based on automated processes or algorithms. The General Application and Implementation Directive 2025, which carries the text quoted here, is made under section 37 of the 1999 Constitution and sections 1(a), 6(c), 61 and 62 of the Nigeria Data Protection Act 2023, an Act in force since 12 June 2023.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot
high_risk_decisions
automated_outreach

Read the law

General Application and Implementation Directive (GAID) 2025
an official regulatory instrument issued by the Nigeria Data Protection Commission under sections 1(a), 6(c), 61 and 62 of the Nigeria Data Protection Act, 2023, which quotes and implements the Act's provisions in detail a directly hosted copy of the Act's own gazetted text was not found among the sources reviewed

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app