President Bola Ahmed Tinubu has signed the Nigeria Data Protection Act 2023 into law, and the bill is expected to offer a better basis for protecting personal data and ensuring that it does not get into the hands of individuals who should not have it, and making the cross-border transfer of personal data unlawful unless expressly permitted by law.

The new law establishes the Nigerian Data Protection Commission, which will take the role of the existing Nigerian Data Protection Bureau. It defines broad rules for processing personal information, including sensitive information processing, data controller requirements such as data breach notifications, performing Data Protection Impact Assessments (DPIAs), and designating a data protection officer (DPO).

It also defines data subject rights such as the right to object, withdraw consent, data portability, and the right not to be subject to a decision based primarily on the automated processing of personal data.