Cross-Border Data Transfers Under the Nigeria Data Protection Act 2023: Legal Challenges and Regulatory Compliance in Nigeria

Contributor: Solomon Ekpe

Introduction

The movement of personal data across national borders is now integral to digital commerce. Cloud computing, outsourced services, multinational corporate systems, payment infrastructure, remote work and software-as-a-service platforms routinely require personal data collected in one jurisdiction to be stored, accessed or otherwise processed in another. These flows support innovation and international trade, but they also expose data subjects to risks arising from divergent privacy laws, foreign government access, cybersecurity incidents, weak enforcement and difficulty obtaining effective remedies outside Nigeria. Nigeria’s legal response must therefore facilitate legitimate data flows without allowing the protection attached to personal data to disappear once the data leaves the country.^[1]

The Nigeria Data Protection Act 2023 (NDPA) addresses that problem directly in Part VIII. Sections 41 to 43 establish the statutory framework for transfers of personal data from Nigeria to another country, while the Nigeria Data Protection Commission’s General Application and Implementation Directive 2025 (GAID) now provides the principal operational guidance for applying those provisions.^[2] The GAID was issued on 20 March 2025 and became effective on 19 September 2025 following a six-month implementation period.^[3]

This article examines the concept and legal basis of cross-border data transfers under the NDPA, the conditions for lawful transfers, the compliance responsibilities of data controllers and processors, the regulatory role of the Nigeria Data Protection Commission (NDPC), the principal practical challenges facing organisations, and the lessons that may be drawn from the European Union’s General Data Protection Regulation (GDPR).

Concept of Cross-Border Data Transfers

A cross-border data transfer occurs where personal data is transferred or made available from Nigeria to a recipient in another country for processing. In practice, a transfer may occur through transmitting files to a foreign recipient, storing data on servers located abroad, using an overseas cloud or software provider, sharing data within a multinational enterprise, or allowing remote access to Nigerian-held data by personnel or service providers outside Nigeria. The key concern is not the physical movement of a document, but whether personal data is transferred from Nigeria to another jurisdiction for processing.^[4]

The distinction matters because cross-border processing can be embedded in ordinary business infrastructure. A Nigerian organisation may process customer, employee or vendor data through applications whose hosting architecture or support functions are located abroad without treating the arrangement as an international transfer. Effective compliance therefore begins with identifying data flows, storage locations, service providers, sub-processors and remote-access arrangements before determining the appropriate legal basis for each transfer.

The NDPA does not address the risk that foreign processing is inherently unlawful. Rather, the concern is that a transfer may place personal data within a legal or institutional environment that affords weaker protection than Nigerian law. Section 42 accordingly requires attention to enforceable data-subject rights, judicial or administrative redress, the rule of law, public-authority access, effective data-protection legislation, the foreign supervisory authority’s independence and enforcement powers, and the recipient country’s international commitments.^[5]

Legal Framework under the NDPA 2023 and the GAID 2025

The NDPA is Nigeria’s principal statute on personal data protection. It applies where a controller or processor is domiciled in, resident in or operating in Nigeria; where the processing occurs in Nigeria; or where a controller or processor outside Nigeria processes the personal data of a data subject in Nigeria.^[6] This territorial reach matters for cross-border transactions because a foreign service provider may fall within the Act even if it has no Nigerian place of incorporation.

At the substantive level, section 24 requires personal data to be processed fairly, lawfully and transparently, for specified purposes, in a manner that is adequate and limited to what is necessary, accurate, appropriately retained and secured. Controllers and processors also owe a duty of care and must demonstrate accountability for their processing activities.^[7] These principles apply to international transfers in addition to the specific rules in Part VIII.

Section 41 is the starting point for a transfer from Nigeria. A controller or processor must not transfer or permit personal data to be transferred to another country unless the recipient is subject to a law, binding corporate rules, contractual clauses, a code of conduct or certification mechanism that affords an adequate level of protection in accordance with the Act, or one of the alternative conditions in section 43 applies. The transferor must also record the legal basis for the transfer and the adequacy of the protection relied upon.^[8]

The mere existence of a privacy statute in the destination country does not determine adequacy. Section 42 requires protection that is substantially similar to the conditions imposed by the NDPA and directs the NDPC to consider the practical enforceability of rights and the institutional environment in which the data will be processed.^[9] The Commission may determine that a country, region, specified sector or standard contractual clauses afford adequate protection, and may approve binding corporate rules, codes of conduct, certification mechanisms or similar transfer instruments. Importantly, the absence of an NDPC determination does not itself establish that a destination is adequate.^[10]

The GAID operationalises this statutory framework. Article 45 provides that Part VIII of the NDPA is the overarching regime for cross-border transfers and directs organisations, pending any further dedicated regulatory instrument, to Schedule 5 for adequacy assessment and the recognised grounds of transfer. Schedule 5 identifies three principal pathways: an adequacy decision of the Commission, a Cross-Border Data Transfer Instrument (CBDTI) approved by the Commission, or another lawful basis recognised by the Act.^[11]

Conditions for Lawful Cross-Border Data Transfers

The first route is adequate protection. A transfer may proceed where the recipient is subject to a legal or organisational mechanism that affords the level of protection required by sections 41 and 42. This may arise from the law of the destination jurisdiction or from recognised safeguards such as binding corporate rules, contractual clauses, codes of conduct or certification mechanisms. Under the GAID, an organisation seeking to rely on a CBDTI must demonstrate that the instrument preserves accountability, access to remedies, and appropriate protection for the data subject.^[12]

The second route consists of the statutory conditions in section 43, which apply where section 42 protection is absent. These include the data subject’s informed and unwithdrawn consent after disclosure of the risks; necessity for the performance of a contract with the data subject or steps requested before entering into that contract; a transfer solely for the data subject’s benefit where consent cannot reasonably be obtained and would likely have been given; important public-interest reasons; the establishment, exercise or defence of legal claims; and protection of vital interests where the data subject is physically or legally incapable of consenting.^[13] These grounds are exceptions to the adequacy route and should be relied upon only where their statutory conditions are genuinely satisfied.

A point of interpretation arises from Article 18(1)(e) of the GAID, which states that consent is required before transferring personal data to a country in respect of which the Commission has not made an adequacy decision. Read literally, that language is broader than section 43, which expressly permits several non-consent bases in the absence of adequacy. The regulatory framework resolves the conflict through its hierarchy: Article 3(2) of the GAID provides that the NDPA prevails where the two instruments conflict, while section 63 of the Act gives the NDPA priority over inconsistent enactments relating to personal-data processing. Article 18 should therefore be read subject to the alternative statutory grounds preserved by section 43.^[14]

In every case, an organisation should distinguish the lawful basis for the underlying processing from the legal basis for the international transfer. A transfer does not become lawful merely because the original collection or use of the data satisfies section 25. Compliance requires both a valid processing basis and a valid transfer mechanism under sections 41 to 43.

Compliance Obligations and the Role of the NDPC

Cross-border compliance extends beyond selecting a transfer mechanism. Section 41(2) requires the transferor to record the basis for the transfer and the adequacy relied upon. More generally, the accountability principle requires organisations to demonstrate that their processing arrangements comply with the Act.^[15] In practical terms, controllers should maintain a reliable inventory of international data flows, identify foreign recipients and sub-processors, document the transfer mechanism, and retain evidence supporting any assessment of adequacy or other statutory ground.

Transparency is equally important. Before collecting personal data, a controller must provide prescribed information to the data subject, including the lawful basis and purpose of processing, recipients or categories of recipients, applicable rights, retention period and complaint mechanisms. Privacy notices should therefore give an intelligible account of material international-processing arrangements where these affect how and by whom personal data will be handled.^[16]

Vendor governance is another central obligation. Where a controller engages a processor, or a processor engages another processor, section 29 requires the engaged processor to comply with the Act, assist in protecting data-subject rights, implement appropriate security measures and provide information necessary to demonstrate compliance. A written agreement must govern the arrangement.^[17] For a foreign service provider, that agreement should address the processing purpose, confidentiality, security, onward transfers, sub-processing, breach response, audit or assurance rights, return or deletion of data, and the transfer safeguard relied upon.

Security obligations continue after data crosses the border. Section 39 requires appropriate technical and organisational measures having regard to the volume and sensitivity of the data, the likelihood and severity of harm, the extent of processing, retention periods, and available technologies. Measures may include encryption, pseudonymisation, resilience controls, risk assessments, testing and regular updates to security measures.^[18] Where the proposed processing is likely to create a high risk to the rights and freedoms of data subjects, section 28 also requires a data privacy impact assessment before processing begins.^[19]

The NDPC performs the central supervisory role. In addition to its general regulatory and enforcement functions, section 42 empowers it to issue adequacy guidance, make adequacy determinations and approve recognised transfer instruments. The Commission’s current guidance directs organisations to obtain an adequacy decision or approval for a CBDTI where they rely on those mechanisms, while preserving the other grounds recognised by sections 41 to 43.^[20] Non-compliance may lead to compliance or enforcement orders and, following investigation, remedial fees or other sanctions under the Act.^[21]

Practical Challenges in Cross-Border Data Transfers

The first practical challenge is visibility. Many organisations do not maintain a complete map of where their data is stored, replicated, backed up or remotely accessed. Cloud services frequently rely on distributed infrastructure and chains of sub-processors. Unless an organisation understands its technology stack and contractual arrangements, it may be unable to identify the countries involved in processing or determine whether its existing agreements adequately regulate onward transfers.

A second challenge is adequacy assessment. Section 42 supplies detailed statutory criteria, while Article 45 and Schedule 5 of the GAID provide operational guidance. Nevertheless, the GAID expressly functions as the relevant guidance until a further regulatory instrument dedicated to cross-border transfers is introduced. Organisations must therefore make careful, documented assessments rather than assume that a destination is adequate simply because it has a data-protection statute or appears on an outdated pre-NDPA list.^[22] Section 42(6) reinforces this by stating that the absence of a Commission determination does not imply adequacy.^[23]

Third, compliance can become complex where multiple legal regimes apply simultaneously. A multinational organisation may be subject to the NDPA in relation to data subjects in Nigeria while also complying with the GDPR, the United Kingdom GDPR or other national privacy laws. Similar terminology does not always produce identical obligations. Controllers must therefore identify the law governing each transfer rather than assume that compliance with one jurisdiction automatically satisfies another.

Fourth, cross-border processing magnifies cybersecurity and enforcement risk. A data exporter may depend on the security practices of foreign providers and sub-processors over whom it has limited operational control. Data may also become subject to foreign public-authority access rules. These concerns explain why the NDPA treats security, enforceable rights, public-authority access and effective remedies as central components of adequate protection.^[24]

Finally, compliance costs can be significant for small and medium-sized enterprises that depend on global software and cloud platforms. The answer, however, is not to dispense with compliance but to make it proportionate and evidence-based. Standardised contractual tools, sector-specific guidance, reliable vendor due diligence and clearer regulatory processes can reduce uncertainty without weakening protection.

Comparative Perspective: the NDPA and the GDPR

The NDPA and the GDPR share the central principle that international transfers must not undermine the protection guaranteed by domestic data-protection law. Chapter V of the GDPR permits transfers based on an adequacy decision, appropriate safeguards or specified derogations, and applies its transfer rules to onward transfers as well.^[25] The Nigerian regime similarly combines adequacy, transfer safeguards and alternative statutory grounds.

However, important structural differences remain. Under the GDPR, the European Commission adopts formal adequacy decisions, while Article 46 identifies a detailed set of safeguards for transfers without adequacy, including binding corporate rules and standard contractual clauses. Article 49 then provides derogations for specific situations.^[26] The European framework is supported by a substantial body of regulatory guidance and case law on the effectiveness of transfer tools and the need to consider the legal environment of the destination jurisdiction.^[27]

Nigeria’s regime is younger but increasingly operational. Section 42 authorises the NDPC to make adequacy determinations and approve transfer instruments, while the GAID provides an interim operational framework through Article 45 and Schedule 5.^[28] Nigeria’s practical priority should therefore be to deepen implementation of the existing statutory architecture rather than replicate the GDPR mechanically. The relevant lesson from the European system is the value of clear, standardised transfer tools, transparent adequacy methodology and sustained regulatory guidance.

Strengthening Regulatory Compliance in Nigeria

The NDPC should continue developing detailed, publicly accessible guidance on adequacy decisions and CBDTI approval. Organisations need clarity on the evidential threshold for demonstrating adequate protection, the documentation required for standard contractual clauses or binding corporate rules, the treatment of onward transfers, and when an existing foreign transfer instrument may satisfy Nigerian requirements. Article 45 itself anticipates further regulatory development, making this a natural next stage in implementation.^[29]

Organisations, for their part, should treat international transfers as a continuing governance function rather than a one-off contractual exercise. A sound compliance programme should identify all international data flows, distinguish controllers from processors, verify the destination and sub-processing chain, select and document the correct transfer mechanism, conduct risk assessments where required, maintain appropriate security controls, update privacy notices, and periodically review whether legal or technical changes affect the transfer.

Data privacy impact assessments should be used where the nature, scope, context or purpose of the processing creates a high risk to data subjects. Data Protection Officers of controllers of major importance should also play an active role in reviewing cross-border arrangements, monitoring compliance and engaging with the NDPC where necessary.^[30]

Finally, Nigeria should continue to strengthen regulatory cooperation with foreign data-protection authorities. Effective cross-border protection depends not only on contractual promises but also on the practical availability of investigation, information sharing and enforcement across jurisdictions. Schedule 5 expressly recognises cooperation between the NDPC and competent foreign authorities as relevant to adequacy, reflecting the reality that international data governance requires international regulatory coordination.^[31]

Conclusion

Cross-border data transfers are indispensable to Nigeria’s participation in the global digital economy. Still, their legality depends on more than the commercial convenience of using foreign technology or service providers. The NDPA establishes a structured regime under which personal data may leave Nigeria only where adequate protection exists or another statutory basis for transfer is available. The GAID 2025 has materially strengthened that framework by providing operational guidance on adequacy, Commission-approved transfer instruments and other lawful grounds.

The central compliance obligation is accountability. Organisations must know where personal data is transferred, identify the legal basis for the transfer, assess the protection available in the destination, contractually regulate foreign processors, maintain appropriate security, provide transparent information to data subjects, and retain evidence demonstrating compliance. Where high-risk processing is involved, that responsibility also extends to prior impact assessment and risk mitigation.

Nigeria’s framework is still developing, particularly on standardised transfer instruments and the practical administration of adequacy decisions. Those gaps do not displace the existing statutory duties. Rather, they make careful documentation, regulatory guidance and institutional cooperation more important. A credible cross-border data regime must permit legitimate digital trade while ensuring that the rights guaranteed by Nigerian law continue to travel with the data.^[32]

Reference:

1. Constitution of the Federal Republic of Nigeria 1999 (as amended), s 37; Nigeria Data Protection Act 2023 (NDPA), s 1. ↑
2. NDPA, ss 41-43; Nigeria Data Protection Commission, Nigeria Data Protection Act General Application and Implementation Directive 2025 (NDPC/NDP ACT-GAID/01/2025) (GAID), art 45 and sch 5. ↑
3. Nigeria Data Protection Commission, Annual Report 2025 (2026) 19 <https://ndpc.gov.ng/wp-content/uploads/2026/02/Print_NDPC-Annual-Report-2025-1.pdf> accessed 31 August 2026. ↑
4. NDPA, ss 41(1) and 65 (definition of ‘processing’). ↑
5. ibid s 42(2). ↑
6. ibid s 2(2). ↑
7. ibid s 24(1) and (3). ↑
8. ibid s 41(1)-(2). ↑
9. ibid s 42(1)-(2). ↑
10. ibid s 42(4)-(7). ↑
11. GAID, art 45(1)-(3) and sch 5 para 1. ↑
12. ibid sch 5 paras 3-5. ↑
13. NDPA, s 43(1)(a)-(f). ↑
14. GAID, arts 3(2) and 18(1)(e); NDPA, ss 43(1) and 63. ↑
15. NDPA, ss 24(3) and 41(2). ↑
16. ibid s 27(1)-(3). ↑
17. ibid s 29(1)-(2). ↑
18. ibid s 39(1)-(2). ↑
19. ibid s 28(1)-(4); GAID, art 28 and sch 4. ↑
20. NDPA, s 42(3)-(5); Nigeria Data Protection Commission, ‘FAQs’ <https://ndpc.gov.ng/faqs/> accessed 31 August 2026. ↑
21. NDPA, ss 47-49. ↑
22. GAID, art 45(2) and sch 5. ↑
23. NDPA, s 42(6). ↑
24. ibid ss 39 and 42(2)(c). ↑
25. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data [2016] OJ L119/1 (GDPR), arts 44-49. ↑
26. ibid arts 45-49. ↑
27. European Data Protection Board, ‘International Transfers and International Cooperation’ <https://www.edpb.europa.eu/topics/international-transfers-and-international-cooperation_en> accessed 31 August 2026; European Data Protection Board, Recommendations 01/2020 on Measures that Supplement Transfer Tools to Ensure Compliance with the EU Level of Protection of Personal Data (18 June 2021). ↑
28. NDPA, s 42(4)-(5); GAID, art 45 and sch 5. ↑
29. GAID, art 45(2) and sch 5. ↑
30. NDPA, ss 28 and 32. ↑
31. GAID, sch 5 para 2(b). ↑
32. Constitution of the Federal Republic of Nigeria 1999 (as amended), s 37; NDPA, ss 1 and 41-43. ↑