DPO Certification Study Notes

The NDPA 2023 is a Nigerian law that aims to protect personal data and privacy rights. It provides a framework for regulating how organisations process personal data.

Personal data, as defined by the NDPA, refers to any information that relates to an identified or identifiable natural person. It includes information that can be used to directly or indirectly identify an individual.

The Nigeria Data Protection Commission (NDPC) is the regulatory body responsible for overseeing compliance and enforcement of the NDPA in Nigeria. It ensures organisations follow data protection principles.

Purpose limitation is a data protection principle that states that data should only be collected and used for specific and legitimate purposes, as stated at the time of collection.

Transparency requires organisations to inform data subjects about how their personal data is being processed. This includes clear information about what data is being collected, how it's used and why.

Organisations must have a lawful basis for processing personal data. This could include consent from the data subject, contractual necessity, legal obligations, or vital interests. Organisational discretion is not a valid basis.

Accountability means organisations need to demonstrate compliance with data protection principles. They must have processes and measures to ensure they are adhering to the NDPA's requirements.

Processing sensitive personal data, like health or religious beliefs, requires explicit consent from the data subject unless specific exceptions apply. Such exceptions include legal obligations or vital interests.

Data processing, as defined by the NDPA, encompasses any operation performed on personal data, including collecting, storing, accessing, transferring, or deleting.

Data minimisation requires collecting and storing only the data necessary for the stated purpose. This prevents unnecessary or excessive data collection.

The NDPC is entrusted with regulating and enforcing data protection laws in Nigeria. It oversees compliance and takes action against organisations that violate the NDPA.

In Nigeria, individuals aged 18 or above can legally give consent for their data processing. This means they have the capacity to understand and agree to how their data will be used.

Storage limitation mandates that data is kept only for as long as it is needed for the intended processing purpose. This prevents indefinite storage of unnecessary data.

A Data Privacy Impact Assessment (DPIA) is conducted to identify and mitigate risks associated with data processing activities. It helps organisations assess the potential impact of their data use on individuals' privacy.

The right to access allows individuals to know if their personal data is being processed and to obtain details about it. They can ask for a copy of their data being held.

Data controllers must respond to access requests from data subjects within 30 days as outlined by the NDPA. This timeframe allows individuals to receive information about their data promptly.

The right to rectification enables data subjects to request corrections to inaccurate or incomplete personal data held about them. This ensures the accuracy of information being processed.

The right to erasure allows individuals to request the deletion of their personal data under certain circumstances. This includes cases where the data is no longer necessary, consent is withdrawn, or processing is unlawful.

The right to restrict processing allows data subjects to request limiting data processing in certain scenarios. This might be when data accuracy is disputed or processing is unlawful.

Data portability enables individuals to transfer their personal data between organisations in a structured, machine-readable format. This gives them more control over their data and facilitates easier data migration.

While data subjects can take legal action for data breaches, this is not specifically categorized as a right under the NDPA. The NDPA focuses on the rights individuals have in relation to how their personal data is processed.

The right to object allows individuals to challenge data processing based on legitimate interests or direct marketing. This enables them to opt out of certain data processing activities.

To exercise the right to access, individuals must submit a formal request to data controllers. This request should clearly indicate the specific information they are seeking about their data.

Data subjects have the right to access their personal data unless certain exceptions apply. These exceptions include national security, legal proceedings, or preventing fraud.

The right to erasure does not apply if the processing is necessary for the performance of a task carried out in the public interest, such as public health or safety, or for compliance with legal obligations.

The right to restrict processing aims to limit data processing in certain scenarios until the accuracy of the data is verified, the legality of the processing is clarified, the purpose for collecting the data no longer applies, or the data subject objects to processing based on legitimate interests.

Data controllers must comply with data subject requests for data portability by providing the information in a structured, commonly used, and machine-readable format that allows for easy transfer to other controllers.

The right to object applies when data is processed based on legitimate interests or for direct marketing purposes. Data subjects can opt out of these activities, such as personalized advertising or profiling based on their data.

When exercising the right to object, data subjects do not have to provide specific reasons for their objection. They can simply express their desire to prevent certain data processing activities. The data controller must respect their decision.

Data controllers may process data without explicit consent if it is necessary for compliance with a legal obligation, such as reporting requirements or tax obligations. This applies when data is processed for specific legal duties.