Nigeria Data Protection Act, 2023, sensitive personal data and a child's data

Nigeria Data Protection Act, 2023, sensitive personal data and a child's data (GAID 2025, arts. 18 and 43)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 12 June 2023.

A sensitive categories rule binding public and private bodies.

As of 19 September 2026.

What it requires

Obtain a data subject's consent before processing sensitive personal data, and before processing the personal data of a child.
Do not seek, give or accept consent in any circumstance that may propagate atrocities, hate, child rights violations or criminal acts.
Where you deploy an emerging technology such as artificial intelligence, the Internet of Things or blockchain to process personal data, set technical and organisational parameters that take account of safeguards for sensitive personal data, safeguards for child rights and other vulnerable groups, the right against solely automated decisions, the right to be forgotten, cross-border data flows, and privacy by design and by default.
Document those parameters and file them with the Commission as part of your Compliance Audit Returns, with an impact assessment that weighs disparate outcomes of the processing and the Data Subjects' Vulnerability Indexes in Schedule 6.
State in your Compliance Audit Returns whether you rely on consent for any of the activities article 18 lists.

What it reaches

Obligation class

Consent, Age verification, Prohibition, DPIA

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Article 18(1) makes consent a requirement, on top of anything else the Act demands, for any direct marketing activity, for processing sensitive personal data, for further processing incompatible with the original purpose, for processing the personal data of a child, before personal data may be transferred to a country the Commission has made no adequacy decision for, and before a data controller makes a decision based solely on automated processing that produces legal effects concerning or significantly affecting the data subject; article 18(2) makes the Compliance Audit Returns state whether the controller or processor relies on consent for any of those activities.

Article 20(2) bars consent from being sought, given or accepted in any circumstance that may propagate atrocities, hate, child rights violations or criminal acts.

Article 43 binds a controller or processor deploying an emerging technology such as artificial intelligence, the Internet of Things or blockchain to set technical and organisational parameters for the processing that take account of the data subject's right not to be subject to a solely automated decision, the right to be forgotten, safeguards for processing sensitive personal data, safeguards for child rights and other vulnerable groups, the regulation of cross-border data flows, and privacy by design and by default; those parameters are documented and filed with the Commission as part of the Returns, and an impact assessment must weigh disparate outcomes and the Data Subjects' Vulnerability Indexes in Schedule 6.

The General Application and Implementation Directive 2025, which carries the text quoted here, is made under section 37 of the 1999 Constitution and sections 1(a), 6(c), 61 and 62 of the Nigeria Data Protection Act 2023, an Act in force since 12 June 2023.

When LexLint raises it

crawls_web
trains_models
serves_minors
high_risk_decisions
automated_outreach
generates_content

Read the law

General Application and Implementation Directive (GAID) 2025
an official regulatory instrument issued by the Nigeria Data Protection Commission under sections 1(a), 6(c), 61 and 62 of the Nigeria Data Protection Act, 2023, which quotes and implements the Act's provisions in detail a directly hosted copy of the Act's own gazetted text was not found among the sources reviewed

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app