Cross border transfer of personal data plays a crucial role in driving commercial expansion, technological innovation, and global collaboration.
Businesses, especially technology-driven enterprises, rely on the seamless exchange of data across jurisdictions to enhance efficiency, minimize operating costs, and improve customer experience. However, as the volume of data transfers rises, so do concerns surrounding privacy and security of personal data.
As Nigeria strengthens its position in the international data ecosystem, understanding the legal and regulatory frameworks governing the cross-border transfer of personal data becomes imperative for organizations as well as data subjects.
This article provides an overview of how Nigerian data protection laws address the cross-border transfer of personal data and highlights certain limitations to the transfer of personal data outside Nigeria.
GROUNDS FOR CROSS-BORDER TRANSFER
Cross-border transfer is the transfer of data from one country to another through file sharing or storing on cloud servers physically located in a different country.
The Nigeria Data Protection Act 2023 (NDPA or the Act) prohibits data controllers1 and data processors2
(DC/DPs) from transferring personal data from Nigeria to another country unless specific minimum conditions are met.
Where a DC/DP needs to transfer personal data outside Nigeria as part of its processes or operations, it must ensure:
- that the recipient of the personal data is subject to a law that affords an adequate level of protection with respect to the personal data; or
- that the recipient of the personal data is subject to binding corporate rules, contractual clauses, code of
conduct, or a certificate mechanism (together, Cross Border Data Transfer Instruments or CBDTIs) that affords
an adequate level of protection with respect to the personal data; or - that any of the conditions set out in section 43 of the Act or in the General Application and Implementation
Directive 2025 (GAID) are met.
Each of the grounds/bases highlighted above will be elaborated upon in the full article below.
