Understanding Privacy Laws: A Comparison of NDPR and GDPR

As I embarked on my GRC cybersecurity internship, one of the initial assignments tasked me with delving into the intricate world of privacy laws, particularly comparing the key provisions of NDPR (Nigeria Data Protection Regulation) with the GDPR (General Data Protection Regulation).

The NDPR and GDPR both aim to guarantee strong protection for individuals regarding their personal data and apply to businesses that collect, use, or share personal data, whether the information is obtained online or offline.

From its title to contents, the NDPR shares numerous similarities with the GDPR. Here’s a breakdown of my findings and insights:

Scope and Applicability:

• NDPR: The NDPR applies to the processing of personal data by data controllers and processors within Nigeria or Nigerian citizens residing outside Nigeria’s territory.
• GDPR: The GDPR has a broader scope, it applies to all organizations processing personal data of individuals residing in the European Union, regardless of the organization’s location.

Consent Mechanisms:

• NDPR: Consent is a fundamental requirement for data processing under the NDPR, and data subjects must be adequately informed before providing consent. It can be withdrawn at anytime.
• GDPR: Likewise, the GDPR emphasizes obtaining freely given, specific, informed and unambiguous consent from data subjects. This can also bee withdrawn at anytime.

Principles of Data Protection:

• Both Nigeria’s NDPR and the European Union’s GDPR share similar core principles such as transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity, and confidentiality.

Rights of Data Subjects:

• NDPR: The NDPR grants data subjects right to access their data, right to request correction, right to object processing, right to request erasure and right to restrict processing.
• GDPR: Data subjects extensive rights under the GDPR, including the right to access their data, right to request correction, right to rectification, right to erasure, right to data portability, and right to object.

Data Processing Requirements:

• Both laws impose obligations on data controllers and processors to implement data processing based on one of the lawful bases (consent, contract, legal obligation) and ensure appropriate security measures are in place to protect personal data.

Data Breach Notification Requirements:

• NDPR: The NDPR mandates data controllers to notify the Nigerian Data Protection Commission (NDPC) and affected data subjects of any data breach within 72 hours of becoming aware of a data breach.
• GDPR: Similarly, the GDPR requires organizations to report data breaches to the relevant supervisory authority within 72 hours unless the breach is unlikely to result in a risk to the rights and freedoms of individuals.

Penalties and Enforcement Mechanisms:

• NDPR: The NDPR sets forth fines of up to 2% of annual gross revenue or ₦10 million, whichever is higher for non-compliance.
• NDPR is enforced by the National Information Technology Development Agency (NITDA). The NITDA is responsible for overseeing compliance with the NDPR, investigating data breaches, carrying out public awareness campaigns, and imposing penalties for non-compliance. It plays a crucial role in promoting data protection and privacy rights within Nigeria’s regulatory framework.
• GDPR: The GDPR imposes more severe penalties, with fines of up to €20 million or 4% of the organization’s global annual turnover, whichever is higher.
• The GDPR is enforced by data protection authorities (DPAs) within each member state of the European Union (EU). Each EU member state has its own DPA tasked with supervising and enforcing GDPR compliance within its jurisdiction. For example, in the UK, the Information Commissioner’s Office (ICO) is responsible for enforcing GDPR compliance, while in Germany, it is the responsibility of the Federal Commissioner for Data Protection and Freedom of Information (German: Bundesbeauftragter für den Datenschutz und die Informationsfreiheit, [BfDI]), and in France it is the responsibility of the National Commission on Informatics and Liberty (French: Commission Nationale de l’Informatique et des Libertés [CNIL]).

In conclusion, while Nigeria’s NDPR shares similarities with the GDPR in key areas such as consent mechanisms, data protection principles, and rights of data subjects, there are also notable differences in scope, penalties, and enforcement mechanisms. Understanding these differences is crucial for organizations operating in both jurisdictions to ensure compliance and protect individuals’ privacy rights.

Thank you for reading. Stay tuned for more insights from my cybersecurity GRC internship journey!