Evaluate the risks and safeguards for transferring personal data of Nigerian data subjects to recipients outside Nigeria.
Legal Framework
Relevant provisions under NDPA and GAID
Sections 41-43 of the NDP Act - Cross-Border Transfer of Personal Data
Sections 41-43 NDPA govern the cross-border transfer of personal data. A data controller or data processor may transfer personal data to a foreign country or an international organisation only if: (a) the Commission has determined that the foreign country, territory, or international organisation ensures an adequate level of protection for personal data; or (b) appropriate safeguards have been provided by the data controller or processor.
Section 42 of the NDP Act - Appropriate Safeguards
Appropriate safeguards may include: (a) legally binding and enforceable instruments between public authorities; (b) binding corporate rules; (c) standard contractual clauses adopted by the Commission; (d) approved codes of conduct; (e) approved certification mechanisms; or (f) contractual clauses authorised by the Commission.
GAID Regulation - Transfer Impact Assessment Requirement
Before transferring personal data outside Nigeria, data controllers must conduct a Transfer Impact Assessment to evaluate: (a) the circumstances of the transfer; (b) the legal framework of the recipient country; (c) the risks to data subjects; and (d) the supplementary measures necessary to ensure adequate protection.
What is a Transfer Impact Assessment?
A Transfer Impact Assessment (TIA) is a systematic evaluation of the risks associated with transferring personal data to a foreign country or international organisation. The TIA helps determine whether adequate protection exists and what supplementary measures may be required.
Key Assessment Areas
- Nature and purpose of the transfer
- Categories of data and data subjects
- Recipient country's data protection laws
- Recipient's security measures
- Government access requests risks
- Data subject rights enforcement
Required Documentation
- Transfer mechanism being relied upon
- Assessment of recipient country adequacy
- Identified risks and their likelihood
- Supplementary measures implemented
- Decision and justification
- Regular review schedule
Lawful Transfer Mechanisms
Permitted Transfer Mechanisms
- NDPC adequacy determination
- Standard Contractual Clauses (SCCs)
- Binding Corporate Rules (BCRs)
- Approved codes of conduct
- Certification mechanisms
- Explicit consent (limited circumstances)
High-Risk Transfer Scenarios
- Countries with no data protection law
- Countries with broad surveillance powers
- Transfers of sensitive personal data
- Large-scale systematic transfers
- Transfers involving vulnerable groups
- Cloud services with unclear data locations