Source: Mondaq

Adeola Oyinlade & Co. provide an analysis of Nigeria’s Data Protection Act 2023 (NDPA) focusing on its restrictions on automated data processing and AI. The NDPA restricts exclusive use of automated decision-making affecting legal rights without data subject consent, requiring human oversight and rights to challenge decisions.

The Act enshrines core data protection principles including lawfulness, fairness, transparency, data minimization, accuracy, and confidentiality. AI use must comply with these principles, and developers must implement organizational and technical measures to protect data subjects’ rights.

The analysis also discusses the interplay with Nigeria’s Copyright Act 2022 and the Cybercrime Act 2015 (amended 2024), emphasizing the need for compliance to avoid legal risks. Data Protection Impact Assessments are mandated for high-risk processing such as surveillance or sensitive personal data.