Nigeria

The Nigeria Data Protection Act, 2023 sets Nigeria's general rules for processing personal data, enforced by the Nigeria Data Protection Commission (NDPC) it establishes.

Consent is required for direct marketing, for processing sensitive personal data, for further processing incompatible with the original purpose, for processing a child's personal data, before transferring personal data to a country the Commission has not made an adequacy decision for, and before a data controller makes a decision based solely on automated processing that produces legal effects concerning or significantly affects a data subject.

A data controller must notify the Commission of a personal data breach likely to result in a risk to individuals' rights and freedoms within 72 hours of becoming aware of it, describing the nature of the breach and, where feasible, the categories and approximate numbers of data subjects and personal data records concerned. It must also notify affected data subjects immediately where the breach is likely to result in a high risk to their rights and freedoms.

Cross-border transfer of personal data proceeds on an adequacy decision by the Commission, a Commission-approved cross-border data transfer instrument (a code of conduct, certification, binding corporate rules, or standard contractual clauses), or another lawful basis including the data subject's consent or a compelling legal or fiduciary obligation.

Data subjects hold a right not to be subject to a decision based solely on automated processes or algorithms, together with rights to rectification, data portability, erasure (a right described as the right to be forgotten), and lodging a complaint with the Commission.

A data controller or data processor of major importance, determined by the Commission by reference to the number of data subjects whose personal data it processes, must register with the Commission and file compliance audit returns.

Section 6(1) makes it an offence for any person, without authorisation, to intentionally access in whole or in part a computer system or network for a fraudulent purpose and to obtain data vital to national security, punishable by imprisonment for not more than five years or a fine of not more than N5,000,000, or both.

Section 6(2) raises the penalty to imprisonment for not more than seven years or a fine of not more than N7,000,000, or both, where the access is committed with the intent of obtaining computer data, securing access to a program, or obtaining commercial, industrial, or classified information.

Section 6(1)'s own text conditions the offence on a fraudulent purpose and on the data obtained being vital to national security, so a plain reading of that subsection does not reach ordinary scraping of a public, unauthenticated page absent both elements; section 6(2)'s aggravated form reaches a wider set of intents but is only reached once subsection (1)'s unauthorised-access element is made out. No reported Nigerian decision has applied section 6 to a scraper.

The Code of Practice for Interactive Computer Service Platforms/Internet Intermediaries, issued by the National Information Technology Development Agency (NITDA) under section 6 of the NITDA Act, 2007 in collaboration with the Nigerian Communications Commission and the National Broadcasting Commission, applies to all Interactive Computer Service Platforms and Internet Intermediaries operating in Nigeria, a term the Code defines broadly to include social media operators, websites, blogs, media-sharing sites, discussion forums, streaming platforms, and gaming platforms.

Part II requires a Platform to label, censor, redact, or otherwise apply access control so that content inappropriate for a child, such as sexually explicit content or images of violence, is not viewable to a child. Part II also requires a Platform to inform users through its terms of service not to create, publish, modify, transmit, store, or share content harmful to a child.

A Platform must also give consideration, in assessing whether content is harmful, to the risk that its dissemination could have a physical or psychological impact on a child or an adult, and must ensure its community rules specify how children will be protected from harmful content they may encounter.

The Code does not itself prescribe an age-verification mechanism, and non-compliance is stated to be a breach of the Nigerian Communications Act, 2003, the National Broadcasting Commission Act, 2004, and the NITDA Act, 2007, rather than a penalty set out in the Code itself.

Section 20(1) of the Copyright Act, 2022 excludes several acts from the exclusive rights conferred by sections 9 to 13, by way of fair dealing, including private use, parody, satire, pastiche, or caricature, non-commercial research and private study, and criticism, review, or the reporting of current events, subject to acknowledging the title and author where the use is public, except where the work is incidentally included in a broadcast.

The excluded acts also include the inclusion of an artistic work situated in a public place in an audiovisual work or broadcast, the incidental inclusion of an artistic work in an audiovisual work or broadcast, and reading or recitation in public or in a non-commercial broadcast of a reasonable extract from a published literary work, with acknowledgment. Separately excluded are quotations in the form of short excerpts from a work.

Also excluded is news of the day for public broadcast or publicly communicated by any other means. Section 20(1)(d)'s proviso conditions the criticism, review, and current-events exception on a fairness test weighing the purpose and character of the use, the nature of the work, the amount and substantiality of the portion used, and the effect of the use on the potential market or value of the work.

Section 20 carries no headline-length or short-extract cap distinct from these tests, and no reported Nigerian decision applies it to a systematic news aggregator rather than an individual quoting or reporting on a published work. Related rights under the Act, covering performers, sound recordings, broadcasts, and expressions of folklore, do not extend to a print or online news publisher's own reporting.