In this article we will be highlighting the most important parts of the Act that you need to pay attention to. The aim is to summarize but also give you the overall information that you need to know about the new Act.
The memorandum of the Nigeria Data Protection Act states:
“An Act to provide the legal framework for the protection of personal data and establish the Nigeria Data Protection Commission for the regulation of the processing of personal data, and for related matters.”
Before we move further, we might need an explanation of some of these terms for a better understanding:
- Data Controller: A data controller is an entity or organization that determines the purposes and means of processing personal data. In simpler terms, they are the ones who decide why and how personal data is processed.
- Data Processor: A data processor is an entity or organization that processes personal data on behalf of the data controller. They act as a service provider to the data controller. Data processors have a contractual relationship with the data controllers and can only process personal data based on the instructions provided by the data controller. They do not determine the purposes or means of processing independently.
- Personal data: Personal data is any information that can be used to identify an individual, such as their name, address, email address, phone number, date of birth, identification number, or any other identifier.
- Processing: Processing personal data includes a wide range of activities, such as collecting, storing, retrieving, using, disclosing, transferring, or deleting personal data. It can also involve combining personal data with other data to derive new insights or information.
With these definitions, you have an easy ride as you follow our train of thought in this article.
The bill signed by President Bola Tinubu provides for the establishment of the Nigeria Data Protection Commission, which will take the role of the existing Nigerian Data Protection Bureau.
One of the duties of the commission is that it shall “ensure the deployment of technological and organizational measures to enhance personal data protection”. The Data controller and Data processor also have the duty to “implement appropriate technical and organizational measures to ensure the security, integrity and confidentiality of personal data in its possession or under its control, including protections against accidental or unlawful destruction, loss, misuse or alteration, unauthorized disclosure or access”.
What this means for organizations is that effective data management must be the order of the day now because there is a law and commission on standby to regulate this. There is no longer a chance for sloppiness when it comes to handling personal data.
It is also noteworthy that the commission would conduct investigations of potential violations by a data controller or a data processor. This means that when you do not process or control data according to the requirements under the Act or other subsidiary legislation made pursuant to this Act, you are liable to be investigated and dealt with fines and other penalties.
This act also defines broad rules for processing personal information, including sensitive information processing, Data controllers are also saddled with clearly stated responsibilities. The act provides for requirements such as data breach notifications, performing Data Protection Impact Assessments (DPIAs), and designating a data protection officer (DPO). As an individual, the most important part of this Act is that it outlines your rights as a data Subject.
Here are the key rights of data subjects:
- Right to Information and Transparency: Data subjects have the right to be informed about the collection, use, and processing of their personal data. This includes details about the purposes of processing, the categories of personal data being processed, the recipients of the data, and any international transfers.
- Right of Access: Data subjects have the right to access their personal data held by data controllers. They can request information about what personal data is being processed, why it is being processed, and obtain a copy of their data.
- Right to Rectification: Data subjects have the right to request the correction or rectification of inaccurate or incomplete personal data.
- Right to Erasure (Right to be Forgotten): Data subjects can request the deletion or removal of their personal data when certain conditions apply. This right is not absolute and depends on factors such as the purpose of processing or the legal basis for retention.
- Right to Restriction of Processing: Data subjects can request the limitation or restriction of the processing of their personal data under certain circumstances. This right is applicable, for example, when the accuracy of the data is contested, or the processing is deemed unlawful.
- Right to Data Portability: Data subjects have the right to receive their personal data in a commonly used and machine-readable format, and, in certain cases, transmit it to another data controller without hindrance.
- Right to Object: Data subjects can object to the processing of their personal data for certain purposes, such as direct marketing or legitimate interests. The data controller must respect this objection unless they can demonstrate compelling legitimate grounds for processing that override the interests, rights, and freedoms of the data Subject.
- Right not to be Subject to Automated Decision-Making: Data subjects have the right to object to decisions based solely on automated processing, including profiling, which significantly affects them. This right aims to ensure that individuals have the opportunity to challenge and seek human intervention in such decisions.
Once the data protection bill is signed by President Bola Tinubu, all organizations, no matter how big or small, will be required to work with the government and follow the rules to protect people’s data.
This is a good time to invest in your career in information security. Hacktales Cybersecurity Foundation Program (CFP) is your best bet to learn skills required to implement strong data protection systems for organizations.