# Nigeria Data Protection — Standards and Legal References

## Primary Legislation and Regulation

- **Nigeria Data Protection Act (NDPA) 2023** — Signed June 12, 2023. Comprehensive data protection legislation establishing the Nigeria Data Protection Commission (NDPC) and a full data protection framework.
- **Nigeria Data Protection Regulation (NDPR) 2019** — Issued by NITDA in January 2019. Nigeria's first data protection regulation; now supplemented by the NDPA.
- **NDPR Implementation Framework 2020** — NITDA guidance on NDPR compliance, including DPCO licensing, audit requirements, and consent management.

## Establishing Legislation

- **National Information Technology Development Agency (NITDA) Act 2007** — Original statutory authority for NITDA's issuance of the NDPR.
- **Nigeria Data Protection Commission (Establishment) Order 2022** — Federal Executive Council order creating the NDPC as interim regulator pending the NDPA.

## International Frameworks

- **African Union Convention on Cyber Security and Personal Data Protection (Malabo Convention) 2014** — Continental framework for data protection; Nigeria signed in 2015. Article 8-13 cover personal data protection principles.
- **ECOWAS Supplementary Act on Personal Data Protection (A/SA.1/01/10) 2010** — Regional data protection framework for West African states including Nigeria. Requires member states to establish data protection authorities.
- **GDPR (EU Regulation 2016/679)** — The NDPR and NDPA draw heavily from GDPR principles, structure, and data subject rights. Relevant for cross-border transfers between Nigeria and EU.
- **AU Data Policy Framework 2022** — African Union framework for data governance and cross-border data flows on the continent.

## Industry Standards

- **ISO/IEC 27001:2022** — Information security management system standard; referenced in NDPR/NDPA security requirements.
- **ISO/IEC 27701:2019** — Privacy information management extension to ISO 27001; supports NDPA compliance programs.
- **NIST Privacy Framework v1.0** — Organizational privacy risk management framework applicable to NDPA compliance.
- **NIST Cybersecurity Framework v2.0** — Security controls supporting NDPA Article 32 equivalent security obligations.

## Regulatory Guidance

- **NDPC Registration Guidelines** — Requirements for data controller and processor registration with the Commission.
- **NDPC DPCO Licensing Framework** — Criteria and procedures for licensing Data Protection Compliance Organisations.
- **NITDA NDPR Audit Guidelines** — Methodology and reporting requirements for annual data protection audits.