A business collects customers' names and phone numbers and has never thought about what the law requires of it. A developer has built an app and nobody wrote down who owns the code. A school, clinic or cooperative is moving its records online. Technology changes how business is done, and the law now attaches specific duties to it.
The law
What the law provides
The Nigeria Data Protection Act 2023 governs the processing of personal data in Nigeria. It requires a lawful basis for processing, sets out the rights of data subjects, imposes security and breach-notification duties, and restricts transfers of personal data out of Nigeria. It is enforced by the Nigeria Data Protection Commission, and certain controllers of major importance must register with the Commission.
The Cybercrimes (Prohibition, Prevention, etc.) Act 2015, as amended, creates offences relating to computer systems and data. Electronic evidence is admissible under section 84 of the Evidence Act 2011, subject to its conditions. Ownership of software, content and other creative work is governed by the Copyright Act 2022.
The process
What happens in practice
Compliance work begins with a review of what personal data an organisation collects, why, where it is kept and who it is shared with. From that review come the documents — privacy notices, data processing agreements, internal policies — and the practical changes the Act requires.
Transactional work concerns the contracts behind technology: software development and licensing, service-level agreements, website terms and conditions, and the assignment of intellectual property created by staff and contractors.
Our role
How the firm acts
We carry out data protection reviews and prepare privacy notices, policies and data processing agreements; advise on registration with the Nigeria Data Protection Commission; and draft and negotiate technology, software and online-platform contracts.
Where disputes arise — over ownership of code or content, misuse of data, or online fraud — we advise on the civil and criminal remedies available and act in the resulting proceedings.
Questions
Questions clients commonly ask
Does the Nigeria Data Protection Act apply to small businesses?
The Act applies to the processing of personal data of persons in Nigeria generally, though some obligations, such as registration, apply only to controllers of major importance. Every organisation that handles personal data should know its basic duties.
Who owns software written by a contractor?
Unless the contract says otherwise, the position can be uncertain and may favour the author. A written agreement assigning the rights should be in place before work starts.
Are WhatsApp messages and emails admissible in court?
Electronic evidence is admissible under section 84 of the Evidence Act 2011 where its conditions are met, usually supported by a certificate of authentication.
Please do not send confidential or sensitive information through this website. Contacting the firm does not create a lawyer–client relationship, and no such relationship exists until the firm has confirmed in writing that it is able to act for you.