Regulating Cross-Border Data Flows In Nigeria: Challenges And Legal Framework

CONTRIBUTOR: OLUGBADE JOHNSON ABIOLA

Introduction

In the digital age, data has emerged as the new oil, fueling innovation, economic growth, and societal transformation.^[1] The global economy increasingly relies on the seamless flow of data across borders, enabling businesses to operate efficiently and governments to deliver services effectively. However, this transnational movement of data presents significant challenges, particularly concerning data privacy, security, and sovereignty. For Nigeria, a burgeoning digital economy necessitates robust legal frameworks to regulate cross-border data flows, ensuring that the rights of citizens are protected while fostering international trade and cooperation.

This article explores the concept and importance of cross-border data flows, examines the challenges Nigeria faces in this domain, and analyses the existing legal frameworks governing such data movements.

CROSS-BORDER DATA FLOWS: MEANING AND SIGNIFICANCE

Cross-border data flows refer to the movement of data across national boundaries, typically through electronic means.^[2] These flows are integral to the functioning of the global digital economy, facilitating international business operations, cloud computing, and real-time communication.^[3] For multinational corporations, cross-border data transfers enable centralized data management, customer relationship management, and supply chain optimization.^[4] Governments also rely on such data flows for international cooperation in areas like security, health, and commerce.^[5]

The significance of cross-border data flows cannot be overstated or overemphasized. They underpin services ranging from online banking and e-commerce to social media and telemedicine.

In Nigeria, the growth of fintech, e-health, and digital services hinges on the ability to transfer data seamlessly across borders. Moreover, participation in global trade agreements and digital markets requires adherence to international data transfer standards, making the regulation of cross-border data flows a strategic imperative for national development.^[6]

However, the transnational nature of data flows raises concerns about data privacy, security, and jurisdiction. Data transferred to countries with weaker data protection laws may be vulnerable to misuse, unauthorized access, or surveillance.^[7] This necessitates the establishment of legal frameworks that balance the free flow of information with the protection of individual rights and national interests.^[8] For Nigeria, crafting such frameworks is essential to safeguard citizens’ data while engaging in the global digital economy.

CHALLENGES ASSOCIATED WITH CROSS-BORDER DATA FLOWS

One major challenge is data commodification, where personal data is treated as a tradable asset. Companies collect vast amounts of user data, often without explicit consent, to monetize through targeted advertising or sale to third parties. This practice raises ethical concerns and exposes individuals to privacy violations. For instance, the Facebook–Cambridge Analytica scandal revealed how the personal data of millions were harvested without consent for political profiling, undermining democratic processes.^[9]

Unlawful processing and misuse of data are also prevalent issues. The 23andMe data breach in 2023 compromised sensitive genetic information of nearly 7 million users, with data being sold on the dark web.^[10] Such incidents highlight the risks associated with inadequate data protection measures and the potential for data to be exploited for malicious purposes.

Similarly, the 2023 MOVEit data breach affected over 2,700 organizations, exposing personal data of approximately 93.3 million individuals, emphasizing the systemic risks in the digital supply chain.^[11]

Another significant challenge is the lack of uniform data protection standards across countries. Data transferred to jurisdictions with weaker privacy laws may not receive adequate protection, leading to potential human rights violations. This disparity complicates international data transfers and necessitates mechanisms to ensure that data exported from Nigeria is afforded equivalent protection abroad. Without such safeguards, individuals’ data may be subject to surveillance, profiling, or unauthorized use in foreign territories.

Furthermore, enforcement of data protection laws across borders is inherently difficult. Jurisdictional limitations hinder the ability of Nigerian authorities to hold foreign entities accountable for data breaches or misuse. This challenge is compounded by the rapid evolution of technology, which often outpaces legislative responses. As a result, individuals may have limited recourse in the event of cross-border data violations, underscoring the need for international cooperation and robust legal frameworks.

LEGAL FRAMEWORK REGULATING CROSS-BORDER DATA FLOWS IN NIGERIA

Nigeria has taken significant steps to regulate cross-border data flows through legislative instruments like the Nigeria Data Protection Act (NDPA) 2023 and the Nigeria Data Protection Regulation (NDPR) 2019.^[12] These laws aim to ensure that personal data transferred outside Nigeria is adequately protected, aligning with global data protection standards.

Section 41 of the NDPA 2023 stipulates that personal data may only be transferred outside Nigeria if the recipient country ensures an adequate level of protection. Specifically, it states:

A data controller or data processor shall not transfer or permit personal data to be transferred from Nigeria to another country, unless— (a) the recipient of the personal data is subject to a law, binding corporate rules, contractual clauses, code of conduct, or certification mechanism that affords an adequate level of protection with respect to the personal data in accordance with this Act.^[13]

Section 42 further elaborates on what constitutes an adequate level of protection, considering factors such as the existence of enforceable data subject rights, effective data protection laws, and independent supervisory authorities in the recipient country.^[14] This ensures that data exported from Nigeria receives protection equivalent to that within the country.

In cases where adequate protection is absent, Section 43 provides alternative bases for data transfer, including:

(a) data subject has provided and not withdrawn consent to such transfer after having been informed of the possible risks…; (b) transfer is necessary for the performance of a contract…; (d) transfer is necessary for important reasons of public interest; (e) transfer is necessary for the establishment, exercise, or defense of legal claims.^[15]

These provisions offer flexibility while maintaining data protection standards.

Section 64 of the NDPA 2023 empowers the Nigeria Data Protection Commission (NDPC) to issue regulations and guidelines to facilitate the implementation of the Act.^[16] This includes the authority to designate categories of personal data subject to additional restrictions on cross-border transfers, ensuring that sensitive data receives heightened protection.

The NDPR 2019 complements the NDPA by providing detailed provisions on data processing and cross-border transfers. It introduced the concept of a “whitelist” of countries with adequate data protection laws, guiding data controllers in making informed decisions about data transfers.^[17]

Furthermore, Section 39 of the 1999 Constitution of Nigeria guarantees the right to privacy, providing a constitutional foundation for data protection.^[18] This underscores the importance of safeguarding personal data and reinforces the legal frameworks established by the NDPA and NDPR.

CONCLUSION

The regulation of cross-border data flows is critical for Nigeria’s digital economy, ensuring that personal data is protected while enabling international collaboration. Challenges such as data commodification, unlawful processing, and jurisdictional limitations necessitate robust legal frameworks and international cooperation. The NDPA 2023 and NDPR 2019 provide comprehensive provisions for data protection, aligning with global standards and safeguarding citizens’ rights. However, continuous evaluation and adaptation of these laws are essential to address emerging threats and technological advancements.

REFERENCE

1. Muyiwa Ajayi Phillip, ‘An Analysis of Nigeria’s Legal Framework for Cross-Border Data Transfer: The AfCFTA Perspective’ (2024) SSRN Electronic Journal, 1–10. http://dx.doi.org/10.2139/ssrn.4798172 ↑
2. Ogonna Annette Onwudiegwu, ‘Navigating the Legal Landscape of Cross-Border Data Transfer and Digital Trade in Nigeria’ (2024) SSRN Electronic Journal 1–5. http://dx.doi.org/10.2139/ssrn.5149446 ↑
3. Muyiwa Ajayi, ‘An Analysis of Nigeria’s Legal Framework for Cross-Border Data the AFCFTA Perspective’ Law Pavillion (1 November 2023). https://www.google.com/amp/s/lawpavilion.com/blog/an-analysis-of-nigerias-legal-framework-for-cross-border-data-the-afcfta-perspective/amp/ accessed 25 May 2025. ↑
4. Ibid. ↑
5. Ibid. ↑
6. For example, the African Continental Free Trade Agreement (AfCFTA) Protocol on Digital Trade, which is under development, requires African signatory nations to facilitate cross-border data flows, particularly for trade-related purposes. See African Union, ‘Protocol to the Agreement Establishing the African Continental Free Trade Area on Digital Trade’ (18 February 2024). https://africanlii.org/akn/aa-au/act/protocol/2024/free_trade_area_on_digital_trade/eng@2024-02-18/source.pdf accessed 25 May 2025. ↑
7. Dan Allen Kipkoech, ‘Navigating the Crossroads: The Challenges of Cross-Border Data Flows under Domestic Laws in Africa’ Strathmore University (23 November 2023). https://cipit.strathmore.edu/navigating-the-crossroads-the-challenges-of-cross-border-data-flows-under-domestic-laws-in-africa/ accessed 25 May 2025. ↑
8. Nkemnechem Danjuma, ‘Examining the Legal Framework for Data Protection in Nigeria viz a viz the Exercise of Human Rights on the Internet’ (2023) 12(1) Benue State University Law Journal, 139–150. ↑
9. Nicholas Confessore, ‘Cambridge Analytica and Facebook: The Scandal and Fallout so Far’ New York Times (4 April 2018). https://www.nytimes.com/2018/04/04/us/politics/cambridge-analytica-scandal-fallout.html accessed 25 May 2025. ↑
10. Mark DeGeurin, ‘Hackers got nearly 7 million people’s data from 23andMe. The firm blamed users in ‘very dumb’ move’ The Guardian (15 February 2024). https://www.theguardian.com/technology/2024/feb/15/23andme-hack-data-genetic-data-selling-response accessed 25 May 2025. ↑
11. Matt Kapko, ‘Progress discloses more MOVEit CVEs, one year after 2023’s fiasco’ Cybersecurity Dive (26 June 2024). https://www.cybersecuritydive.com/news/moveit-file-transfer-cves/719933/ accessed 25 May 2025. ↑
12. NDPA 2023; NDPR 2019. ↑
13. NDPA 2023, s. 41. ↑
14. Ibid, s. 42. ↑
15. Ibid, s. 43. ↑
16. Ibid, s. 64. ↑
17. NDPR 2019, art. 2.11 ↑
18. CAP. C23, LFN 2004, s. 39. ↑