Navigating Cross Border Data Transfers – Key Insights Under Nigeria’s Data Protection Laws

Cross border data transfers drive commercial expansion, technological innovation and global collaboration.

Businesses, especially technology companies, rely on moving data across borders to work efficiently, cut costs and improve customer experience. However, as transfer volumes rise, so do concerns about the privacy and security of personal data.

Nigeria is strengthening its place in the global data ecosystem. Organisations and individuals therefore need to understand the rules on sending personal data abroad. This article outlines how Nigerian law regulates cross border data transfers and where the limits lie.

What counts as a cross border data transfer

A cross-border transfer moves data from one country to another. That includes sharing files or storing data on cloud servers located in a different country.

The Nigeria Data Protection Act 2023 (NDPA or the Act) bars data controllers¹ and data processors² (DC/DPs) from transferring personal data out of Nigeria unless minimum conditions are met. A DC/DP that needs to transfer data abroad must ensure at least one of the following:

• the recipient is subject to a law that gives adequate protection to the personal data; or
• the recipient is bound by binding corporate rules, contractual clauses, a code of conduct or a certification mechanism (together, Cross Border Data Transfer Instruments or CBDTIs) that give adequate protection; or
• a condition in section 43 of the Act or the General Application and Implementation Directive 2025 (GAID) applies.

DC/DPs must also record the basis for each transfer and why the protection is adequate.

Transfers based on adequacy

The Nigeria Data Protection Commission (NDPC) assesses whether a country, region or sector applies principles substantially similar to the NDPA. In doing so, it considers several factors:

• enforceable data subject rights, with accessible, impartial and independent routes to redress;
• an effective data protection law that is stable and not easily overridden;
• how far public authorities can access transferred data, and whether that access is necessary;
• binding international commitments that affect data flows;
• cooperation instruments between the NDPC and the foreign authority; and
• a functioning, independent supervisory authority with real enforcement powers.

Transfers based on a CBDTI

Alternatively, a DC/DP may rely on a CBDTI. The chosen instrument must allow proper monitoring of data flows, accountability between the parties, access to remedies for data subjects and personal data sovereignty.

Crucially, the NDPC must approve the CBDTI before anyone relies on it. In reviewing it, the Commission considers any data protection audit by a licensed compliance organisation, together with evidence that the DC/DP follows recognised standards.

Nigeria has no standard template CBDTIs yet, unlike the United Kingdom, which publishes template international data transfer agreements. As a result, organisations must submit bespoke drafts. The NDPC could improve clarity by issuing standard forms adapted to Nigerian law.

Transfers under special conditions

Where there is no adequacy decision or approved CBDTI, a transfer may still proceed if at least one special condition applies:

• the data subject has consented, understands the risks and has not withdrawn consent;
• the transfer is necessary to perform a contract with the data subject, or to take pre-contract steps at their request;
• the transfer is solely for the data subject’s benefit, consent is impracticable, and they would likely agree;
• the transfer is necessary for public interest reasons, or for legal claims;
• the transfer protects the vital interests of a data subject who cannot give consent; or
• the transfer rests on a compelling legal right or duty distinct from the DC/DP’s business interests.

For businesses that move data offshore routinely, the practical step is to map every transfer and document its legal basis now. Our notes on data protection considerations in corporate acquisitions and QR code payments in Nigeria cover related technology law issues.

For the full article, including the definitions and references, download the newsletter using the button below.