data/processed/Nigeria_Data_Protection_Act_2023_structure.json

{
  "metadata": {
    "filename": "Nigeria_Data_Protection_Act_2023.pdf",
    "file_size": 658393,
    "created": "2025-08-10T21:24:35.257438",
    "modified": "2025-08-10T19:21:16.252500",
    "document_type": "data_protection",
    "estimated_sections": 14,
    "dates_mentioned": [],
    "word_count": 14852,
    "character_count": 90379,
    "pdf_metadata": {
      "format": "PDF 1.7",
      "title": "C:\\ADEX\\ADENIJI\\ACT 2\\NIGERIA D",
      "author": "ADENIJI",
      "subject": "",
      "keywords": "",
      "creator": "",
      "producer": "Microsoft: Print To PDF",
      "creationDate": "D:20230705095010+01'00'",
      "modDate": "D:20230705095010+01'00'",
      "trapped": "",
      "encryption": null
    }
  },
  "extraction_method": "pdfplumber",
  "sections": [
    {
      "level": 1,
      "number": "000",
      "title": "00 Overseas : N65,",
      "content": "",
      "page_start": 1,
      "page_end": 1,
      "content_length": 0
    },
    {
      "level": 1,
      "number": "000",
      "title": "00 [Surface Mail]",
      "content": "N80,",
      "page_start": 1,
      "page_end": 1,
      "content_length": 4
    },
    {
      "level": 1,
      "number": "000",
      "title": "00 [Second Class Air Mail]. Present issue N3,500 per copy. Subscribers who wish to obtain Gazette",
      "content": "after 1st January should apply to the Federal Government Printer, Lagos for amended Subscriptions.",
      "page_start": 1,
      "page_end": 1,
      "content_length": 98
    },
    {
      "level": 2,
      "number": "000.00",
      "title": "Overseas : N65,",
      "content": "",
      "page_start": 1,
      "page_end": 1,
      "content_length": 0
    },
    {
      "level": 2,
      "number": "000.00",
      "title": "[Surface Mail]",
      "content": "N80,",
      "page_start": 1,
      "page_end": 1,
      "content_length": 4
    },
    {
      "level": 2,
      "number": "000.00",
      "title": "[Second Class Air Mail]. Present issue N3,500 per copy. Subscribers who wish to obtain Gazette",
      "content": "after 1st January should apply to the Federal Government Printer, Lagos for amended Subscriptions.",
      "page_start": 1,
      "page_end": 1,
      "content_length": 98
    },
    {
      "level": 1,
      "number": "1",
      "title": "Objectives",
      "content": "",
      "page_start": 3,
      "page_end": 3,
      "content_length": 0
    },
    {
      "level": 1,
      "number": "2",
      "title": "Application",
      "content": "",
      "page_start": 3,
      "page_end": 3,
      "content_length": 0
    },
    {
      "level": 1,
      "number": "3",
      "title": "Exemption of application",
      "content": "PART II — ESTABLISHMENT OF THE NIGERIA DATA PROTECTION COMMISSION,\nAND ITS GOVERNING COUNCIL",
      "page_start": 3,
      "page_end": 3,
      "content_length": 92
    },
    {
      "level": 1,
      "number": "4",
      "title": "Establishment of the Nigeria Data Protection Commission",
      "content": "",
      "page_start": 3,
      "page_end": 3,
      "content_length": 0
    },
    {
      "level": 1,
      "number": "5",
      "title": "Functions of the Commission",
      "content": "",
      "page_start": 3,
      "page_end": 3,
      "content_length": 0
    },
    {
      "level": 1,
      "number": "6",
      "title": "Powers of the Commission",
      "content": "",
      "page_start": 3,
      "page_end": 3,
      "content_length": 0
    },
    {
      "level": 1,
      "number": "7",
      "title": "Independence of the Commission",
      "content": "",
      "page_start": 3,
      "page_end": 3,
      "content_length": 0
    },
    {
      "level": 1,
      "number": "8",
      "title": "Establishment of the Governing Council of the Commission",
      "content": "",
      "page_start": 3,
      "page_end": 3,
      "content_length": 0
    },
    {
      "level": 1,
      "number": "9",
      "title": "Appointment of members of the Council",
      "content": "",
      "page_start": 3,
      "page_end": 3,
      "content_length": 0
    },
    {
      "level": 1,
      "number": "10",
      "title": "Tenure of members of the Council",
      "content": "",
      "page_start": 3,
      "page_end": 3,
      "content_length": 0
    },
    {
      "level": 1,
      "number": "11",
      "title": "Cessation of membership",
      "content": "",
      "page_start": 3,
      "page_end": 3,
      "content_length": 0
    },
    {
      "level": 1,
      "number": "12",
      "title": "Functions and powers of the Council",
      "content": "",
      "page_start": 3,
      "page_end": 3,
      "content_length": 0
    },
    {
      "level": 1,
      "number": "13",
      "title": "Conflict of interest",
      "content": "PART III — APPOINTMENT OF THE NATIONAL COMMISSIONER, AND OTHER\nSTAFF OF THE COMMISSION",
      "page_start": 3,
      "page_end": 3,
      "content_length": 86
    },
    {
      "level": 1,
      "number": "14",
      "title": "Appointment of the National Commissioner for the Commission",
      "content": "",
      "page_start": 3,
      "page_end": 3,
      "content_length": 0
    },
    {
      "level": 1,
      "number": "15",
      "title": "Secretary to the Council",
      "content": "",
      "page_start": 3,
      "page_end": 3,
      "content_length": 0
    },
    {
      "level": 1,
      "number": "16",
      "title": "Staff of the Commission",
      "content": "",
      "page_start": 3,
      "page_end": 3,
      "content_length": 0
    },
    {
      "level": 1,
      "number": "17",
      "title": "Staff regulations and discipline",
      "content": "",
      "page_start": 3,
      "page_end": 3,
      "content_length": 0
    },
    {
      "level": 1,
      "number": "18",
      "title": "Pension",
      "content": "PART IV — FINANCIAL PROVISIONS",
      "page_start": 3,
      "page_end": 3,
      "content_length": 30
    },
    {
      "level": 1,
      "number": "19",
      "title": "Funds of the Commission",
      "content": "",
      "page_start": 3,
      "page_end": 3,
      "content_length": 0
    },
    {
      "level": 1,
      "number": "20",
      "title": "Expenditure of the Fund",
      "content": "",
      "page_start": 3,
      "page_end": 3,
      "content_length": 0
    },
    {
      "level": 1,
      "number": "21",
      "title": "Power to borrow and accept gifts",
      "content": "",
      "page_start": 3,
      "page_end": 3,
      "content_length": 0
    },
    {
      "level": 1,
      "number": "22",
      "title": "Account and audit",
      "content": "23. Annual reports and estimates",
      "page_start": 3,
      "page_end": 3,
      "content_length": 32
    },
    {
      "level": 1,
      "number": "24",
      "title": "Principles of personal data processing",
      "content": "",
      "page_start": 4,
      "page_end": 4,
      "content_length": 0
    },
    {
      "level": 1,
      "number": "25",
      "title": "Lawful basis of personal data processing",
      "content": "",
      "page_start": 4,
      "page_end": 4,
      "content_length": 0
    },
    {
      "level": 1,
      "number": "26",
      "title": "Consent",
      "content": "",
      "page_start": 4,
      "page_end": 4,
      "content_length": 0
    },
    {
      "level": 1,
      "number": "27",
      "title": "Provision of information to the data subject",
      "content": "",
      "page_start": 4,
      "page_end": 4,
      "content_length": 0
    },
    {
      "level": 1,
      "number": "28",
      "title": "Data privacy impact assessment",
      "content": "",
      "page_start": 4,
      "page_end": 4,
      "content_length": 0
    },
    {
      "level": 1,
      "number": "29",
      "title": "Obligations of the data controller and data processor",
      "content": "",
      "page_start": 4,
      "page_end": 4,
      "content_length": 0
    },
    {
      "level": 1,
      "number": "30",
      "title": "Sensitive personal data",
      "content": "",
      "page_start": 4,
      "page_end": 4,
      "content_length": 0
    },
    {
      "level": 1,
      "number": "31",
      "title": "Children or persons lacking the legal capacity to consent",
      "content": "",
      "page_start": 4,
      "page_end": 4,
      "content_length": 0
    },
    {
      "level": 1,
      "number": "32",
      "title": "Data Protection Officers",
      "content": "",
      "page_start": 4,
      "page_end": 4,
      "content_length": 0
    },
    {
      "level": 1,
      "number": "33",
      "title": "Data protection compliance services",
      "content": "PART VI — RIGHTS OF A DATA SUBJECT",
      "page_start": 4,
      "page_end": 4,
      "content_length": 34
    },
    {
      "level": 1,
      "number": "34",
      "title": "Rights of a data subject",
      "content": "",
      "page_start": 4,
      "page_end": 4,
      "content_length": 0
    },
    {
      "level": 1,
      "number": "35",
      "title": "Withdrawal of consent",
      "content": "",
      "page_start": 4,
      "page_end": 4,
      "content_length": 0
    },
    {
      "level": 1,
      "number": "36",
      "title": "Right to object",
      "content": "",
      "page_start": 4,
      "page_end": 4,
      "content_length": 0
    },
    {
      "level": 1,
      "number": "37",
      "title": "Automated decision making",
      "content": "",
      "page_start": 4,
      "page_end": 4,
      "content_length": 0
    },
    {
      "level": 1,
      "number": "38",
      "title": "Data portability",
      "content": "PART VII — DATA SECURITY",
      "page_start": 4,
      "page_end": 4,
      "content_length": 24
    },
    {
      "level": 1,
      "number": "39",
      "title": "Security, integrity, and confidentiality",
      "content": "",
      "page_start": 4,
      "page_end": 4,
      "content_length": 0
    },
    {
      "level": 1,
      "number": "40",
      "title": "Personal data breaches",
      "content": "PART VIII — CROSS-BORDER TRANSFERS OF PERSONAL DATA",
      "page_start": 4,
      "page_end": 4,
      "content_length": 51
    },
    {
      "level": 1,
      "number": "41",
      "title": "Basis for cross-border transfer of personal data",
      "content": "",
      "page_start": 4,
      "page_end": 4,
      "content_length": 0
    },
    {
      "level": 1,
      "number": "42",
      "title": "Adequacy of protection",
      "content": "",
      "page_start": 4,
      "page_end": 4,
      "content_length": 0
    },
    {
      "level": 1,
      "number": "43",
      "title": "Other bases for transfer of personal data outside Nigeria",
      "content": "PART IX — REGISTRATION AND FEES",
      "page_start": 4,
      "page_end": 4,
      "content_length": 31
    },
    {
      "level": 1,
      "number": "44",
      "title": "Registration of data controllers and data processors of major importance",
      "content": "",
      "page_start": 4,
      "page_end": 4,
      "content_length": 0
    },
    {
      "level": 1,
      "number": "45",
      "title": "Fees and levies",
      "content": "PART X — ENFORCEMENT",
      "page_start": 4,
      "page_end": 4,
      "content_length": 20
    },
    {
      "level": 1,
      "number": "46",
      "title": "Complaints and investigations",
      "content": "",
      "page_start": 4,
      "page_end": 4,
      "content_length": 0
    },
    {
      "level": 1,
      "number": "47",
      "title": "Compliance orders",
      "content": "",
      "page_start": 4,
      "page_end": 4,
      "content_length": 0
    },
    {
      "level": 1,
      "number": "48",
      "title": "Enforcement orders",
      "content": "",
      "page_start": 4,
      "page_end": 4,
      "content_length": 0
    },
    {
      "level": 1,
      "number": "49",
      "title": "Offences and penalties",
      "content": "",
      "page_start": 4,
      "page_end": 4,
      "content_length": 0
    },
    {
      "level": 1,
      "number": "50",
      "title": "Judicial review",
      "content": "",
      "page_start": 4,
      "page_end": 4,
      "content_length": 0
    },
    {
      "level": 1,
      "number": "51",
      "title": "Civil remedies",
      "content": "",
      "page_start": 4,
      "page_end": 4,
      "content_length": 0
    },
    {
      "level": 1,
      "number": "52",
      "title": "Forfeiture",
      "content": "53. Joint and vicarious liability",
      "page_start": 4,
      "page_end": 4,
      "content_length": 33
    },
    {
      "level": 1,
      "number": "54",
      "title": "Limitation of suits against the Commission",
      "content": "",
      "page_start": 5,
      "page_end": 5,
      "content_length": 0
    },
    {
      "level": 1,
      "number": "55",
      "title": "Service of documents",
      "content": "",
      "page_start": 5,
      "page_end": 5,
      "content_length": 0
    },
    {
      "level": 1,
      "number": "56",
      "title": "Restriction on execution against property of the Commission",
      "content": "",
      "page_start": 5,
      "page_end": 5,
      "content_length": 0
    },
    {
      "level": 1,
      "number": "57",
      "title": "Indemnity of staff, members, and employees of the Commission",
      "content": "",
      "page_start": 5,
      "page_end": 5,
      "content_length": 0
    },
    {
      "level": 1,
      "number": "58",
      "title": "Power of arrest, search, and seizure",
      "content": "",
      "page_start": 5,
      "page_end": 5,
      "content_length": 0
    },
    {
      "level": 1,
      "number": "59",
      "title": "Right to appear in court",
      "content": "PART XII — MISCELLANEOUS PROVISIONS",
      "page_start": 5,
      "page_end": 5,
      "content_length": 35
    },
    {
      "level": 1,
      "number": "60",
      "title": "Directives by the Minister",
      "content": "",
      "page_start": 5,
      "page_end": 5,
      "content_length": 0
    },
    {
      "level": 1,
      "number": "61",
      "title": "Regulations",
      "content": "",
      "page_start": 5,
      "page_end": 5,
      "content_length": 0
    },
    {
      "level": 1,
      "number": "62",
      "title": "Directives, codes, and guidelines",
      "content": "",
      "page_start": 5,
      "page_end": 5,
      "content_length": 0
    },
    {
      "level": 1,
      "number": "63",
      "title": "Priority of the Act",
      "content": "",
      "page_start": 5,
      "page_end": 5,
      "content_length": 0
    },
    {
      "level": 1,
      "number": "64",
      "title": "Transitional provisions",
      "content": "",
      "page_start": 5,
      "page_end": 5,
      "content_length": 0
    },
    {
      "level": 1,
      "number": "65",
      "title": "Interpretation",
      "content": "",
      "page_start": 5,
      "page_end": 5,
      "content_length": 0
    },
    {
      "level": 1,
      "number": "66",
      "title": "Citation",
      "content": "SCHEDULE",
      "page_start": 5,
      "page_end": 5,
      "content_length": 8
    },
    {
      "level": 1,
      "number": "1",
      "title": "—(1) The objectives of this Act are to — Objectives",
      "content": "(a) safeguard the fundamental rights and freedoms, and the interests of\ndata subjects, as guaranteed under the Constitution of the Federal Republic\nof Nigeria, 1999 ;\n(b) provide for the regulation of processing of personal data ;\n(c) promote data processing practices that safeguard the security of\npersonal data and privacy of data subjects ;\n(d) ensure that personal data is processed in a fair, lawful and accountable\nmanner ;\n(e) protect data subjects’ rights, and provide means of recourse and\n...",
      "page_start": 7,
      "page_end": 7,
      "content_length": 1061
    },
    {
      "level": 1,
      "number": "2",
      "title": "—(1) This Act shall apply to the processing of personal data, whether Application",
      "content": "by automated means or not.\n(2) This Act shall apply, where the —\n(a) data controller or data processor is domiciled in, resident in, or\noperating in Nigeria ;\n(b) processing of personal data occurs within Nigeria ; or\n(c) the data controller or the data processor is not domiciled in, resident\nin, or operating in Nigeria, but is processing personal data of a data subject\nin Nigeria.",
      "page_start": 7,
      "page_end": 7,
      "content_length": 384
    },
    {
      "level": 3,
      "number": "1",
      "title": "The objectives of this Act are to — Objectives",
      "content": "",
      "page_start": 7,
      "page_end": 7,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "a",
      "title": "safeguard the fundamental rights and freedoms, and the interests of",
      "content": "data subjects, as guaranteed under the Constitution of the Federal Republic\nof Nigeria, 1999 ;",
      "page_start": 7,
      "page_end": 7,
      "content_length": 94
    },
    {
      "level": 3,
      "number": "b",
      "title": "provide for the regulation of processing of personal data ;",
      "content": "",
      "page_start": 7,
      "page_end": 7,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "c",
      "title": "promote data processing practices that safeguard the security of",
      "content": "personal data and privacy of data subjects ;",
      "page_start": 7,
      "page_end": 7,
      "content_length": 44
    },
    {
      "level": 3,
      "number": "d",
      "title": "ensure that personal data is processed in a fair, lawful and accountable",
      "content": "manner ;",
      "page_start": 7,
      "page_end": 7,
      "content_length": 8
    },
    {
      "level": 3,
      "number": "e",
      "title": "protect data subjects’ rights, and provide means of recourse and",
      "content": "remedies, in the event of the breach of the data subject’s rights ;\n(f ) ensure that data controllers and data processors fulfil their obligations\nto data subjects ;",
      "page_start": 7,
      "page_end": 7,
      "content_length": 165
    },
    {
      "level": 3,
      "number": "g",
      "title": "establish an impartial, independent, and effective regulatory",
      "content": "Commission to superintend over data protection and privacy issues, and\nsupervise data controllers and data processors ; and",
      "page_start": 7,
      "page_end": 7,
      "content_length": 123
    },
    {
      "level": 3,
      "number": "h",
      "title": "strengthen the legal foundations of the national digital economy and",
      "content": "guarantee the participation of Nigeria in the regional and global economies\nthrough the beneficial and trusted use of personal data.\n2.—",
      "page_start": 7,
      "page_end": 7,
      "content_length": 136
    },
    {
      "level": 3,
      "number": "1",
      "title": "This Act shall apply to the processing of personal data, whether Application",
      "content": "by automated means or not.",
      "page_start": 7,
      "page_end": 7,
      "content_length": 26
    },
    {
      "level": 3,
      "number": "2",
      "title": "This Act shall apply, where the —",
      "content": "",
      "page_start": 7,
      "page_end": 7,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "a",
      "title": "data controller or data processor is domiciled in, resident in, or",
      "content": "operating in Nigeria ;",
      "page_start": 7,
      "page_end": 7,
      "content_length": 22
    },
    {
      "level": 3,
      "number": "b",
      "title": "processing of personal data occurs within Nigeria ; or",
      "content": "",
      "page_start": 7,
      "page_end": 7,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "c",
      "title": "the data controller or the data processor is not domiciled in, resident",
      "content": "in, or operating in Nigeria, but is processing personal data of a data subject\nin Nigeria.",
      "page_start": 7,
      "page_end": 7,
      "content_length": 90
    },
    {
      "level": 1,
      "number": "3",
      "title": "—(1) This Act shall not apply to the processing of personal data",
      "content": "of carried out by one or more persons solely for personal or household purposes:\napplication\nProvided that such processing for personal or household purposes does not\nconstitute a violation of fundamental right to privacy of a data subject.\n(2) Subject to the rights and freedoms under the Constitution and the\nlimitations, the obligations under Part V, other than sections 24, 25, 32, and 40\nof this Act, shall not apply to a data controller or data processor if the processing\nof personal data is —...",
      "page_start": 8,
      "page_end": 8,
      "content_length": 1906
    },
    {
      "level": 1,
      "number": "4",
      "title": "—(1) There is established the Nigeria Data Protection Commission",
      "content": "of the (in this Act, referred to as “the Commission”).\nNigeria Data\nProtection (2) The Commission —\nCommission\n(a) shall be a body corporate, with perpetual succession and a\ncommon seal ;\n(b) may sue or be sued in its corporate name ; and\n(c) may acquire, hold and dispose of its property.",
      "page_start": 8,
      "page_end": 8,
      "content_length": 289
    },
    {
      "level": 3,
      "number": "1",
      "title": "This Act shall not apply to the processing of personal data",
      "content": "of carried out by one or more persons solely for personal or household purposes:\napplication\nProvided that such processing for personal or household purposes does not\nconstitute a violation of fundamental right to privacy of a data subject.",
      "page_start": 8,
      "page_end": 8,
      "content_length": 240
    },
    {
      "level": 3,
      "number": "2",
      "title": "Subject to the rights and freedoms under the Constitution and the",
      "content": "limitations, the obligations under Part V, other than sections 24, 25, 32, and 40\nof this Act, shall not apply to a data controller or data processor if the processing\nof personal data is —",
      "page_start": 8,
      "page_end": 8,
      "content_length": 189
    },
    {
      "level": 3,
      "number": "a",
      "title": "carried out by a competent authority for the purposes of the",
      "content": "prevention, investigation, detection, prosecution, or adjudication of a criminal\noffence or the execution of a criminal penalty, in accordance with any\napplicable law ;",
      "page_start": 8,
      "page_end": 8,
      "content_length": 168
    },
    {
      "level": 3,
      "number": "b",
      "title": "carried out by a competent authority for the purposes of prevention",
      "content": "or control of a national public health emergency ;",
      "page_start": 8,
      "page_end": 8,
      "content_length": 50
    },
    {
      "level": 3,
      "number": "c",
      "title": "carried out by a competent authority, as is necessary for national",
      "content": "security ;",
      "page_start": 8,
      "page_end": 8,
      "content_length": 10
    },
    {
      "level": 3,
      "number": "d",
      "title": "in respect of publication in the public interest, for journalism,",
      "content": "educational, artistic and literary purposes to the extent that such obligations\nand rights are incompatible with such purposes ; or",
      "page_start": 8,
      "page_end": 8,
      "content_length": 131
    },
    {
      "level": 3,
      "number": "e",
      "title": "necessary for the establishment, exercise, or defense of legal claims,",
      "content": "whether in court proceedings, or in an administrative or out-of-court\nprocedure.",
      "page_start": 8,
      "page_end": 8,
      "content_length": 80
    },
    {
      "level": 3,
      "number": "3",
      "title": "The Commission may by regulation prescribe types of personal data",
      "content": "and processing that may be exempted from application of this Act.",
      "page_start": 8,
      "page_end": 8,
      "content_length": 65
    },
    {
      "level": 3,
      "number": "4",
      "title": "Notwithstanding the provisions of this Act, the Commission may",
      "content": "issue a guidance notice containing legal safeguards and best practices to a\ndata controller or processor, in respect of any aspect of data processing\nexempted under this section where in the opinion of the Commission, such\nprocessing violates or is likely to violate sections 24 and 25 of this Act.\nPART II — ESTABLISHMENT OF THE NIGERIA DATA PROTECTION\nCOMMISSION, AND ITS GOVERNING COUNCIL\nEstablishment 4.—",
      "page_start": 8,
      "page_end": 8,
      "content_length": 409
    },
    {
      "level": 3,
      "number": "1",
      "title": "There is established the Nigeria Data Protection Commission",
      "content": "of the (in this Act, referred to as “the Commission”).\nNigeria Data\nProtection",
      "page_start": 8,
      "page_end": 8,
      "content_length": 78
    },
    {
      "level": 3,
      "number": "2",
      "title": "The Commission —",
      "content": "Commission",
      "page_start": 8,
      "page_end": 8,
      "content_length": 10
    },
    {
      "level": 3,
      "number": "a",
      "title": "shall be a body corporate, with perpetual succession and a",
      "content": "common seal ;",
      "page_start": 8,
      "page_end": 8,
      "content_length": 13
    },
    {
      "level": 3,
      "number": "b",
      "title": "may sue or be sued in its corporate name ; and",
      "content": "(c) may acquire, hold and dispose of its property.",
      "page_start": 8,
      "page_end": 8,
      "content_length": 50
    },
    {
      "level": 1,
      "number": "5",
      "title": "The Commission shall — Functions of",
      "content": "the\n(a) regulate the deployment of technological and organisational measures\nCommission\nto enhance personal data protection ;\n(b) foster the development of personal data protection technologies, in\naccordance with recognised international best practices and applicable\ninternational law ;\n(c) where necessary, accredit, license, and register suitable persons to\nprovide data protection compliance services ;\n(d) register data controllers and data processors of major importance ;\n(e) promote awarenes...",
      "page_start": 9,
      "page_end": 9,
      "content_length": 1981
    },
    {
      "level": 3,
      "number": "3",
      "title": "The Commission —",
      "content": "",
      "page_start": 9,
      "page_end": 9,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "a",
      "title": "shall have its head office in the Federal Capital Territory ; and",
      "content": "",
      "page_start": 9,
      "page_end": 9,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "b",
      "title": "may maintain other offices, in any part of Nigeria, for the purposes",
      "content": "of achieving the objects of the Commission.",
      "page_start": 9,
      "page_end": 9,
      "content_length": 43
    },
    {
      "level": 3,
      "number": "4",
      "title": "Subject to the approval of the Council, the National Commissioner",
      "content": "may acquire other offices and premises for the use of the Commission.\n5. The Commission shall — Functions of\nthe",
      "page_start": 9,
      "page_end": 9,
      "content_length": 112
    },
    {
      "level": 3,
      "number": "a",
      "title": "regulate the deployment of technological and organisational measures",
      "content": "Commission\nto enhance personal data protection ;",
      "page_start": 9,
      "page_end": 9,
      "content_length": 48
    },
    {
      "level": 3,
      "number": "b",
      "title": "foster the development of personal data protection technologies, in",
      "content": "accordance with recognised international best practices and applicable\ninternational law ;",
      "page_start": 9,
      "page_end": 9,
      "content_length": 90
    },
    {
      "level": 3,
      "number": "c",
      "title": "where necessary, accredit, license, and register suitable persons to",
      "content": "provide data protection compliance services ;",
      "page_start": 9,
      "page_end": 9,
      "content_length": 45
    },
    {
      "level": 3,
      "number": "d",
      "title": "register data controllers and data processors of major importance ;",
      "content": "",
      "page_start": 9,
      "page_end": 9,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "e",
      "title": "promote awareness on the obligation of data controllers and data",
      "content": "processors under this Act ;\n(f ) promote public awareness and understanding of personal data\nprotection, rights and obligations imposed under this Act, and the risks to\npersonal data ;",
      "page_start": 9,
      "page_end": 9,
      "content_length": 184
    },
    {
      "level": 3,
      "number": "g",
      "title": "receive complaints relating to violations of this Act or subsidiary",
      "content": "legislation made under this Act ;",
      "page_start": 9,
      "page_end": 9,
      "content_length": 33
    },
    {
      "level": 3,
      "number": "h",
      "title": "collaborate with any relevant ministry, department, agency, body,",
      "content": "company, firm, or person for the attainment of the objectives of this Act ;",
      "page_start": 9,
      "page_end": 9,
      "content_length": 75
    },
    {
      "level": 3,
      "number": "i",
      "title": "ensure compliance with national and international personal data",
      "content": "protection obligations and best practice ;",
      "page_start": 9,
      "page_end": 9,
      "content_length": 42
    },
    {
      "level": 3,
      "number": "j",
      "title": "participate in international fora and engage with national and regional",
      "content": "authorities responsible for data protection with a view to developing efficient\nstrategies for the regulation of cross-border transfers of personal data ;",
      "page_start": 9,
      "page_end": 9,
      "content_length": 154
    },
    {
      "level": 3,
      "number": "k",
      "title": "determine whether countries, regions, business sectors, binding",
      "content": "corporate rules, contractual clauses, codes of conduct, or certification\nmechanisms, afford adequate personal data protection standards for cross-\nborder transfers ;",
      "page_start": 9,
      "page_end": 9,
      "content_length": 165
    },
    {
      "level": 3,
      "number": "l",
      "title": "collect and publish information with respect to personal data",
      "content": "protection, including personal data breaches ;",
      "page_start": 9,
      "page_end": 9,
      "content_length": 46
    },
    {
      "level": 3,
      "number": "m",
      "title": "advise government on policy issues relating to data protection and",
      "content": "privacy ;",
      "page_start": 9,
      "page_end": 9,
      "content_length": 9
    },
    {
      "level": 3,
      "number": "n",
      "title": "submit legislative proposals to the Minister necessary for strengthening",
      "content": "personal data protection in Nigeria ; and",
      "page_start": 9,
      "page_end": 9,
      "content_length": 41
    },
    {
      "level": 3,
      "number": "o",
      "title": "carry out other legal actions as are necessary for the performance",
      "content": "of the functions of the Commission.",
      "page_start": 9,
      "page_end": 9,
      "content_length": 35
    },
    {
      "level": 1,
      "number": "6",
      "title": "The Commission shall have powers to —",
      "content": "the\n(a) oversee the implementation of the provisions of this Act ;\nCommission\n(b) prescribe fees payable by data controllers and data processors in\naccordance with data processing activities ;\n(c) issue regulations, rules, directives and guidance under this Act ;\n(d) prescribe the manner and frequency of filing, and content of\ncompliance returns by data controllers and data processors of major\nimportance to the Commission ;\n(e) call for information from a person, or inspect any documents with\nre...",
      "page_start": 10,
      "page_end": 10,
      "content_length": 1026
    },
    {
      "level": 1,
      "number": "7",
      "title": "The Commission shall be independent in the performance of its",
      "content": "of the functions under this Act.\nCommission\nEstablishment",
      "page_start": 10,
      "page_end": 10,
      "content_length": 57
    },
    {
      "level": 1,
      "number": "8",
      "title": "—(1) There shall be for the Commission, a Governing Council (in this",
      "content": "of the Act referred to as “the Council”), which shall consist of —\nGoverning\nCouncil of (a) a part-time Chairman, who shall be a retired judge of Nigeria ;\nthe (b) the National Commissioner ;\nCommission (c) a representative, not below the rank of a Director or its equivalent,\nfrom —\n(i) the Federal Ministry responsible for Justice,\n(ii) the Federal Ministry responsible for communications and digital\neconomy,\n(iii) the Central Bank of Nigeria, and\n(iv) a law enforcement agency ; and\n(d) one repre...",
      "page_start": 10,
      "page_end": 10,
      "content_length": 904
    },
    {
      "level": 3,
      "number": "a",
      "title": "oversee the implementation of the provisions of this Act ;",
      "content": "Commission",
      "page_start": 10,
      "page_end": 10,
      "content_length": 10
    },
    {
      "level": 3,
      "number": "b",
      "title": "prescribe fees payable by data controllers and data processors in",
      "content": "accordance with data processing activities ;",
      "page_start": 10,
      "page_end": 10,
      "content_length": 44
    },
    {
      "level": 3,
      "number": "c",
      "title": "issue regulations, rules, directives and guidance under this Act ;",
      "content": "",
      "page_start": 10,
      "page_end": 10,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "d",
      "title": "prescribe the manner and frequency of filing, and content of",
      "content": "compliance returns by data controllers and data processors of major\nimportance to the Commission ;",
      "page_start": 10,
      "page_end": 10,
      "content_length": 98
    },
    {
      "level": 3,
      "number": "e",
      "title": "call for information from a person, or inspect any documents with",
      "content": "respect to any thing done under this Act ;\n(f ) conduct investigations into any violation of a requirement under this\nAct or subsidiary legislation made under this Act by a data controller or a\ndata processor ;",
      "page_start": 10,
      "page_end": 10,
      "content_length": 210
    },
    {
      "level": 3,
      "number": "g",
      "title": "impose penalties in respect of any violation of the provisions of this",
      "content": "Act or subsidiary legislation made under this Act ;",
      "page_start": 10,
      "page_end": 10,
      "content_length": 51
    },
    {
      "level": 3,
      "number": "h",
      "title": "acquire assets, and sell, let, lease, or dispose of any of its property ; and",
      "content": "",
      "page_start": 10,
      "page_end": 10,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "i",
      "title": "perform such other acts as are necessary to give effect to the functions",
      "content": "of the Commission.\nIndependence 7. The Commission shall be independent in the performance of its\nof the functions under this Act.\nCommission\nEstablishment 8.—",
      "page_start": 10,
      "page_end": 10,
      "content_length": 158
    },
    {
      "level": 3,
      "number": "1",
      "title": "There shall be for the Commission, a Governing Council (in this",
      "content": "of the Act referred to as “the Council”), which shall consist of —\nGoverning\nCouncil of",
      "page_start": 10,
      "page_end": 10,
      "content_length": 87
    },
    {
      "level": 3,
      "number": "a",
      "title": "a part-time Chairman, who shall be a retired judge of Nigeria ;",
      "content": "the",
      "page_start": 10,
      "page_end": 10,
      "content_length": 3
    },
    {
      "level": 3,
      "number": "b",
      "title": "the National Commissioner ;",
      "content": "Commission",
      "page_start": 10,
      "page_end": 10,
      "content_length": 10
    },
    {
      "level": 3,
      "number": "c",
      "title": "a representative, not below the rank of a Director or its equivalent,",
      "content": "from —",
      "page_start": 10,
      "page_end": 10,
      "content_length": 6
    },
    {
      "level": 3,
      "number": "i",
      "title": "the Federal Ministry responsible for Justice,",
      "content": "(ii) the Federal Ministry responsible for communications and digital\neconomy,\n(iii) the Central Bank of Nigeria, and\n(iv) a law enforcement agency ; and",
      "page_start": 10,
      "page_end": 10,
      "content_length": 152
    },
    {
      "level": 3,
      "number": "d",
      "title": "one representative from the private sector.",
      "content": "",
      "page_start": 10,
      "page_end": 10,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "2",
      "title": "Members of the Council other than the National Commissioner shall",
      "content": "be paid such allowances as may be determined, in collaboration with the\nRevenue Mobilisation Allocation and Fiscal Commission.\nSchedule",
      "page_start": 10,
      "page_end": 10,
      "content_length": 135
    },
    {
      "level": 3,
      "number": "3",
      "title": "The supplementary provisions set out in the Schedule to this Act",
      "content": "shall apply with respect to the proceedings of the Council, and other matters\ncontained in it.",
      "page_start": 10,
      "page_end": 10,
      "content_length": 94
    },
    {
      "level": 1,
      "number": "9",
      "title": "—(1) The Chairman and non-ex-officio members of the Council shall Appointment",
      "content": "be appointed by the President, on the recommendation of the Minister. of members\nof the\n(2) A member appointed to the Council under section 8 of this Act Council\nfrom—\n(a) the private sector shall be a Nigerian and possess not less than five\nyears cognate experience and proficiency in data protection and privacy;\nand\n(b) government, under section 8(1)(c) of this Act, may have proficiency\nin data protection and privacy.",
      "page_start": 11,
      "page_end": 11,
      "content_length": 422
    },
    {
      "level": 1,
      "number": "10",
      "title": "—(1) Members of the Council other than the National Commissioner Tenure of",
      "content": "shall be part-time members. members of\nthe Council\n(2) The Chairman and non-ex-officio members of the Council shall hold\noffice —\n(a) for a term of four years, and may be eligible for re-appointment for\nanother term of four years, and no more ; and\n(b) on such terms and conditions, as may be specified in their letters of\nappointment.",
      "page_start": 11,
      "page_end": 11,
      "content_length": 335
    },
    {
      "level": 1,
      "number": "11",
      "title": "—(1) A person shall cease to be a member of the Council, where the Cessation of",
      "content": "person — membership\n(a) dies ;\n(b) becomes bankrupt or compounds with his creditors ;\n(c) is convicted of a felony or any offence involving dishonesty or fraud ;\n(d) is disqualified from professional qualification ;\n(e) is guilty of a serious misconduct with regard to the discharge of the\nperson’s duties ;\n(f ) under section 8(1)(c) of this Act, ceases to occupy the office by\nvirtue of which he became a member of the Council ; or\n(g) resigns from appointment by giving at least two months’ notice...",
      "page_start": 11,
      "page_end": 11,
      "content_length": 1007
    },
    {
      "level": 3,
      "number": "1",
      "title": "The Chairman and non-ex-officio members of the Council shall Appointment",
      "content": "be appointed by the President, on the recommendation of the Minister. of members\nof the",
      "page_start": 11,
      "page_end": 11,
      "content_length": 87
    },
    {
      "level": 3,
      "number": "2",
      "title": "A member appointed to the Council under section 8 of this Act Council",
      "content": "from—",
      "page_start": 11,
      "page_end": 11,
      "content_length": 5
    },
    {
      "level": 3,
      "number": "a",
      "title": "the private sector shall be a Nigerian and possess not less than five",
      "content": "years cognate experience and proficiency in data protection and privacy;\nand",
      "page_start": 11,
      "page_end": 11,
      "content_length": 76
    },
    {
      "level": 3,
      "number": "b",
      "title": "government, under section 8",
      "content": "",
      "page_start": 11,
      "page_end": 11,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "1",
      "title": "(c) of this Act, may have proficiency",
      "content": "in data protection and privacy.\n10.—",
      "page_start": 11,
      "page_end": 11,
      "content_length": 36
    },
    {
      "level": 3,
      "number": "1",
      "title": "Members of the Council other than the National Commissioner Tenure of",
      "content": "shall be part-time members. members of\nthe Council",
      "page_start": 11,
      "page_end": 11,
      "content_length": 50
    },
    {
      "level": 3,
      "number": "2",
      "title": "The Chairman and non-ex-officio members of the Council shall hold",
      "content": "office —",
      "page_start": 11,
      "page_end": 11,
      "content_length": 8
    },
    {
      "level": 3,
      "number": "a",
      "title": "for a term of four years, and may be eligible for re-appointment for",
      "content": "another term of four years, and no more ; and",
      "page_start": 11,
      "page_end": 11,
      "content_length": 45
    },
    {
      "level": 3,
      "number": "b",
      "title": "on such terms and conditions, as may be specified in their letters of",
      "content": "appointment.\n11.—",
      "page_start": 11,
      "page_end": 11,
      "content_length": 17
    },
    {
      "level": 3,
      "number": "1",
      "title": "A person shall cease to be a member of the Council, where the Cessation of",
      "content": "person — membership",
      "page_start": 11,
      "page_end": 11,
      "content_length": 19
    },
    {
      "level": 3,
      "number": "a",
      "title": "dies ;",
      "content": "",
      "page_start": 11,
      "page_end": 11,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "b",
      "title": "becomes bankrupt or compounds with his creditors ;",
      "content": "",
      "page_start": 11,
      "page_end": 11,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "c",
      "title": "is convicted of a felony or any offence involving dishonesty or fraud ;",
      "content": "",
      "page_start": 11,
      "page_end": 11,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "d",
      "title": "is disqualified from professional qualification ;",
      "content": "",
      "page_start": 11,
      "page_end": 11,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "e",
      "title": "is guilty of a serious misconduct with regard to the discharge of the",
      "content": "person’s duties ;\n(f ) under section 8",
      "page_start": 11,
      "page_end": 11,
      "content_length": 38
    },
    {
      "level": 3,
      "number": "1",
      "title": "(c) of this Act, ceases to occupy the office by",
      "content": "virtue of which he became a member of the Council ; or",
      "page_start": 11,
      "page_end": 11,
      "content_length": 54
    },
    {
      "level": 3,
      "number": "g",
      "title": "resigns from appointment by giving at least two months’ notice, in",
      "content": "writing, addressed to the President.",
      "page_start": 11,
      "page_end": 11,
      "content_length": 36
    },
    {
      "level": 3,
      "number": "2",
      "title": "The President, on the recommendation of the Minister, may remove",
      "content": "a member of the Council, where satisfied that it is not in the interest of the\nCommission or the public that the member continues in that office.",
      "page_start": 11,
      "page_end": 11,
      "content_length": 145
    },
    {
      "level": 3,
      "number": "3",
      "title": "Where a member of the Council ceases to hold office before the",
      "content": "expiration of the term, the President shall appoint a person to fill the vacancy,\nand the person so appointed shall hold office for the remainder of the term of\noffice of that member.",
      "page_start": 11,
      "page_end": 11,
      "content_length": 183
    },
    {
      "level": 1,
      "number": "12",
      "title": "—(1) The functions of the Council are to —",
      "content": "and powers\n(a) formulate and provide overall policy direction of the affairs of the\nof the\nCouncil Commission ;\n(b) approve strategic plans, action plans and budget support programmes\nsubmitted by the National Commissioner ;\n(c) approve annual reports and financial reports submitted by the National\nCommissioner ;\n(d) approve the terms and conditions of service of the employees of the\nAct No. 4, Commission, including remuneration, allowances and pension benefits in\n2014 accordance with the Pensio...",
      "page_start": 12,
      "page_end": 12,
      "content_length": 1087
    },
    {
      "level": 1,
      "number": "13",
      "title": "—(1) A member of the Council shall —",
      "content": "interest\n(a) ensure that personal interest shall not conflict with the member’s\nduties under this Act ;\n(b) not make secret profit in the course of discharging official duties ;\n(c) fully disclose to the Council any personal, commercial, financial, or\nother interest, which may directly or indirectly hold or be connected with\nthe business of the Commission or becomes the subject of consideration by\nthe Council ;\n(d) subject to subsection (3), be ineligible to participate in any Council\ndeliberati...",
      "page_start": 12,
      "page_end": 12,
      "content_length": 1126
    },
    {
      "level": 3,
      "number": "1",
      "title": "The functions of the Council are to —",
      "content": "and powers",
      "page_start": 12,
      "page_end": 12,
      "content_length": 10
    },
    {
      "level": 3,
      "number": "a",
      "title": "formulate and provide overall policy direction of the affairs of the",
      "content": "of the\nCouncil Commission ;",
      "page_start": 12,
      "page_end": 12,
      "content_length": 27
    },
    {
      "level": 3,
      "number": "b",
      "title": "approve strategic plans, action plans and budget support programmes",
      "content": "submitted by the National Commissioner ;",
      "page_start": 12,
      "page_end": 12,
      "content_length": 40
    },
    {
      "level": 3,
      "number": "c",
      "title": "approve annual reports and financial reports submitted by the National",
      "content": "Commissioner ;",
      "page_start": 12,
      "page_end": 12,
      "content_length": 14
    },
    {
      "level": 3,
      "number": "d",
      "title": "approve the terms and conditions of service of the employees of the",
      "content": "Act No. 4, Commission, including remuneration, allowances and pension benefits in\n2014 accordance with the Pension Reform Act ;",
      "page_start": 12,
      "page_end": 12,
      "content_length": 127
    },
    {
      "level": 3,
      "number": "e",
      "title": "approve staff regulations for the appointment, promotion and discipline",
      "content": "of staff of the Commission ;\n(f ) provide advice and counsel to the National Commissioner;",
      "page_start": 12,
      "page_end": 12,
      "content_length": 90
    },
    {
      "level": 3,
      "number": "g",
      "title": "assist the National Commissioner in matters relating to compliance",
      "content": "by ministries, departments and agencies of government with this Act ; and",
      "page_start": 12,
      "page_end": 12,
      "content_length": 73
    },
    {
      "level": 3,
      "number": "h",
      "title": "handle such other matters, as may be prescribed by any other",
      "content": "provision of this Act.",
      "page_start": 12,
      "page_end": 12,
      "content_length": 22
    },
    {
      "level": 3,
      "number": "2",
      "title": "The Council shall have the power to delegate any of its functions",
      "content": "under this Act to a committee set up by it, in accordance with the provisions of\nthis Act.\nConflict of 13.—",
      "page_start": 12,
      "page_end": 12,
      "content_length": 107
    },
    {
      "level": 3,
      "number": "1",
      "title": "A member of the Council shall —",
      "content": "interest",
      "page_start": 12,
      "page_end": 12,
      "content_length": 8
    },
    {
      "level": 3,
      "number": "a",
      "title": "ensure that personal interest shall not conflict with the member’s",
      "content": "duties under this Act ;",
      "page_start": 12,
      "page_end": 12,
      "content_length": 23
    },
    {
      "level": 3,
      "number": "b",
      "title": "not make secret profit in the course of discharging official duties ;",
      "content": "",
      "page_start": 12,
      "page_end": 12,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "c",
      "title": "fully disclose to the Council any personal, commercial, financial, or",
      "content": "other interest, which may directly or indirectly hold or be connected with\nthe business of the Commission or becomes the subject of consideration by\nthe Council ;",
      "page_start": 12,
      "page_end": 12,
      "content_length": 162
    },
    {
      "level": 3,
      "number": "d",
      "title": "subject to subsection",
      "content": "",
      "page_start": 12,
      "page_end": 12,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "3",
      "title": ", be ineligible to participate in any Council",
      "content": "deliberation and voting-related matter ; and",
      "page_start": 12,
      "page_end": 12,
      "content_length": 44
    },
    {
      "level": 3,
      "number": "e",
      "title": "not accept any gift or advantage in whatever form or manner, for",
      "content": "anything done or likely to be done with respect to the responsibilities of the\nCouncil.",
      "page_start": 12,
      "page_end": 12,
      "content_length": 87
    },
    {
      "level": 3,
      "number": "2",
      "title": "A member of the Council, who contravenes the provisions of",
      "content": "paragraphs",
      "page_start": 12,
      "page_end": 12,
      "content_length": 10
    },
    {
      "level": 3,
      "number": "b",
      "title": "and",
      "content": "",
      "page_start": 12,
      "page_end": 12,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "e",
      "title": ", commits an offence and is liable on conviction to —",
      "content": "",
      "page_start": 12,
      "page_end": 12,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "a",
      "title": "in the case of a contravention of paragraph",
      "content": "",
      "page_start": 12,
      "page_end": 12,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "b",
      "title": ", a fine of at",
      "content": "least N10,000,000 or imprisonment for a term not more than three\nyears, or both ; or",
      "page_start": 12,
      "page_end": 12,
      "content_length": 84
    },
    {
      "level": 3,
      "number": "b",
      "title": "in the case of a contravention of paragraph",
      "content": "",
      "page_start": 12,
      "page_end": 12,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "d",
      "title": ", a fine of at least",
      "content": "N5,000,000, or imprisonment for a term not more than two years, or both.",
      "page_start": 12,
      "page_end": 12,
      "content_length": 72
    },
    {
      "level": 1,
      "number": "14",
      "title": "—(1) There shall be for the Commission, a National Commissioner, Appointment",
      "content": "who shall be — of the\nNational\n(a) appointed by the President, on the recommendation of the Minister ; Commissioner\n(b) the chief executive and accounting officer of the Commission; and for the\nCommission\n(c) responsible for the execution of the policies and administration of\nthe affairs of the Commission.\n(2) The National Commissioner shall —\n(a) hold a certification in data protection from a training body which is\nduly accredited in line with international best practices ; and\n(b) possess at l...",
      "page_start": 13,
      "page_end": 13,
      "content_length": 1179
    },
    {
      "level": 1,
      "number": "15",
      "title": "The National Commissioner shall be the Secretary to the Council, Secretary to",
      "content": "and — the Council\n(a) be responsible to the Council;\n(b) keep the Council’s records;\n(c) conduct the Council’s correspondence ; and\n(d) discharge such other duties, as the Council may determine.",
      "page_start": 13,
      "page_end": 13,
      "content_length": 194
    },
    {
      "level": 1,
      "number": "16",
      "title": "The Commission shall, subject to the approval of the Council, recruit Staff of the",
      "content": "directly or by secondment from the Public Service of the Federation, such Commission\nnumber of staff, as it deems necessary and expedient —\n(a) for the proper and efficient performance of its functions ; and\n(b) on such terms and conditions, with remunerations, allowances, and\nbenefits.",
      "page_start": 13,
      "page_end": 13,
      "content_length": 287
    },
    {
      "level": 3,
      "number": "1",
      "title": "There shall be for the Commission, a National Commissioner, Appointment",
      "content": "who shall be — of the\nNational",
      "page_start": 13,
      "page_end": 13,
      "content_length": 30
    },
    {
      "level": 3,
      "number": "a",
      "title": "appointed by the President, on the recommendation of the Minister ; Commissioner",
      "content": "",
      "page_start": 13,
      "page_end": 13,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "b",
      "title": "the chief executive and accounting officer of the Commission; and for the",
      "content": "Commission",
      "page_start": 13,
      "page_end": 13,
      "content_length": 10
    },
    {
      "level": 3,
      "number": "c",
      "title": "responsible for the execution of the policies and administration of",
      "content": "the affairs of the Commission.",
      "page_start": 13,
      "page_end": 13,
      "content_length": 30
    },
    {
      "level": 3,
      "number": "2",
      "title": "The National Commissioner shall —",
      "content": "",
      "page_start": 13,
      "page_end": 13,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "a",
      "title": "hold a certification in data protection from a training body which is",
      "content": "duly accredited in line with international best practices ; and",
      "page_start": 13,
      "page_end": 13,
      "content_length": 63
    },
    {
      "level": 3,
      "number": "b",
      "title": "possess at least 10 years cognate experience, at a senior management",
      "content": "level, in data protection, cybersecurity management, information and\ncommunication technology, law, consumer protection, management science,\nor other relevant disciplines.",
      "page_start": 13,
      "page_end": 13,
      "content_length": 171
    },
    {
      "level": 3,
      "number": "3",
      "title": "A person appointed as the National Commissioner shall not hold any",
      "content": "other management position in a Ministry, Department, or Agency of\nGovernment, corporation, company, or any other business establishment.",
      "page_start": 13,
      "page_end": 13,
      "content_length": 136
    },
    {
      "level": 3,
      "number": "4",
      "title": "The National Commissioner shall hold office —",
      "content": "",
      "page_start": 13,
      "page_end": 13,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "a",
      "title": "for a term of five years, and may be re-appointed for another term",
      "content": "of five years, and no more ; and",
      "page_start": 13,
      "page_end": 13,
      "content_length": 32
    },
    {
      "level": 3,
      "number": "b",
      "title": "on such other terms and conditions as may be specified in the letter",
      "content": "of appointment.\n15. The National Commissioner shall be the Secretary to the Council, Secretary to\nand — the Council",
      "page_start": 13,
      "page_end": 13,
      "content_length": 115
    },
    {
      "level": 3,
      "number": "a",
      "title": "be responsible to the Council;",
      "content": "",
      "page_start": 13,
      "page_end": 13,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "b",
      "title": "keep the Council’s records;",
      "content": "",
      "page_start": 13,
      "page_end": 13,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "c",
      "title": "conduct the Council’s correspondence ; and",
      "content": "",
      "page_start": 13,
      "page_end": 13,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "d",
      "title": "discharge such other duties, as the Council may determine.",
      "content": "16. The Commission shall, subject to the approval of the Council, recruit Staff of the\ndirectly or by secondment from the Public Service of the Federation, such Commission\nnumber of staff, as it deems necessary and expedient —",
      "page_start": 13,
      "page_end": 13,
      "content_length": 226
    },
    {
      "level": 3,
      "number": "a",
      "title": "for the proper and efficient performance of its functions ; and",
      "content": "",
      "page_start": 13,
      "page_end": 13,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "b",
      "title": "on such terms and conditions, with remunerations, allowances, and",
      "content": "benefits.",
      "page_start": 13,
      "page_end": 13,
      "content_length": 9
    },
    {
      "level": 1,
      "number": "17",
      "title": "—(1) The Commission may make staff regulations relating",
      "content": "regulations generally to the conditions of service of the staff, and such regulations\nand\nmay provide for —\ndiscipline\n(a) the appointment, promotion, and disciplinary control of staff of the\nCommission ; and\n(b) appeals by staff against dismissal or other disciplinary measures :\nProvided that pending the making of such staff regulations, any instrument\nrelating to conditions of service in the Public Service of the Federation shall\nbe applicable, with such modifications, as may be necessary to t...",
      "page_start": 14,
      "page_end": 14,
      "content_length": 640
    },
    {
      "level": 1,
      "number": "18",
      "title": "—(1) Staff of the Commission shall be entitled to pension and other",
      "content": "retirement benefits, as prescribed under the Pension Reform Act.\nAct No. 4,\n2014 (2) Without prejudice to the provisions of subsection (1), nothing in this\nAct shall prevent the appointment of a person to any office on conditions,\nwhich preclude the grant of pension and other retirement benefits in respect\nof that office.\n(3) For the application of the provisions of the Pension Reform Act, any\npower exercisable by a Minister or other authority of the Federal Government,\nother than the power to m...",
      "page_start": 14,
      "page_end": 14,
      "content_length": 640
    },
    {
      "level": 1,
      "number": "19",
      "title": "—(1) The Commission shall establish a Fund (in this Act referred to",
      "content": "Commission as “the Fund”) for the performance of its functions under this Act.\n(2) There shall be paid into the Fund established under subsection (1) —\n(a) a take-off grant as may be appropriated by the National Assembly\nwhich shall be drawn in the following manner —\n(i) 20% of the take-off grant shall be from the Consolidated Revenue\nFund of the Federation,\n(ii) 40% of the take-off grant shall be from the Nigerian\nCommunications Commission, and\n(iii) 40% of the take-off grant shall be from the ...",
      "page_start": 14,
      "page_end": 14,
      "content_length": 823
    },
    {
      "level": 3,
      "number": "1",
      "title": "The Commission may make staff regulations relating",
      "content": "regulations generally to the conditions of service of the staff, and such regulations\nand\nmay provide for —\ndiscipline",
      "page_start": 14,
      "page_end": 14,
      "content_length": 118
    },
    {
      "level": 3,
      "number": "a",
      "title": "the appointment, promotion, and disciplinary control of staff of the",
      "content": "Commission ; and",
      "page_start": 14,
      "page_end": 14,
      "content_length": 16
    },
    {
      "level": 3,
      "number": "b",
      "title": "appeals by staff against dismissal or other disciplinary measures :",
      "content": "Provided that pending the making of such staff regulations, any instrument\nrelating to conditions of service in the Public Service of the Federation shall\nbe applicable, with such modifications, as may be necessary to the staff of the\nCommission.",
      "page_start": 14,
      "page_end": 14,
      "content_length": 246
    },
    {
      "level": 3,
      "number": "2",
      "title": "The staff regulations made under subsection",
      "content": "",
      "page_start": 14,
      "page_end": 14,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "1",
      "title": "shall not have effect",
      "content": "until approved by the Council.\nPension 18.—",
      "page_start": 14,
      "page_end": 14,
      "content_length": 43
    },
    {
      "level": 3,
      "number": "1",
      "title": "Staff of the Commission shall be entitled to pension and other",
      "content": "retirement benefits, as prescribed under the Pension Reform Act.\nAct No. 4,\n2014",
      "page_start": 14,
      "page_end": 14,
      "content_length": 80
    },
    {
      "level": 3,
      "number": "2",
      "title": "Without prejudice to the provisions of subsection",
      "content": "",
      "page_start": 14,
      "page_end": 14,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "1",
      "title": ", nothing in this",
      "content": "Act shall prevent the appointment of a person to any office on conditions,\nwhich preclude the grant of pension and other retirement benefits in respect\nof that office.",
      "page_start": 14,
      "page_end": 14,
      "content_length": 167
    },
    {
      "level": 3,
      "number": "3",
      "title": "For the application of the provisions of the Pension Reform Act, any",
      "content": "power exercisable by a Minister or other authority of the Federal Government,\nother than the power to make regulations under the Pension Reform Act, shall\nbe vested in, and exercisable by the Council.\nPART IV — FINANCIAL PROVISIONS\nFund of the 19.—",
      "page_start": 14,
      "page_end": 14,
      "content_length": 248
    },
    {
      "level": 3,
      "number": "1",
      "title": "The Commission shall establish a Fund (in this Act referred to",
      "content": "Commission as “the Fund”) for the performance of its functions under this Act.",
      "page_start": 14,
      "page_end": 14,
      "content_length": 78
    },
    {
      "level": 3,
      "number": "2",
      "title": "There shall be paid into the Fund established under subsection",
      "content": "",
      "page_start": 14,
      "page_end": 14,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "1",
      "title": "—",
      "content": "",
      "page_start": 14,
      "page_end": 14,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "a",
      "title": "a take-off grant as may be appropriated by the National Assembly",
      "content": "which shall be drawn in the following manner —",
      "page_start": 14,
      "page_end": 14,
      "content_length": 46
    },
    {
      "level": 3,
      "number": "i",
      "title": "20% of the take-off grant shall be from the Consolidated Revenue",
      "content": "Fund of the Federation,\n(ii) 40% of the take-off grant shall be from the Nigerian\nCommunications Commission, and\n(iii) 40% of the take-off grant shall be from the National Information\nTechnology Development Agency ;",
      "page_start": 14,
      "page_end": 14,
      "content_length": 215
    },
    {
      "level": 3,
      "number": "b",
      "title": "donations, gifts, loans, grants, aids, endowments, and voluntary",
      "content": "contributions ;",
      "page_start": 14,
      "page_end": 14,
      "content_length": 15
    },
    {
      "level": 3,
      "number": "c",
      "title": "returns on investments of the Commission ;",
      "content": "",
      "page_start": 14,
      "page_end": 14,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "d",
      "title": "levies, fees, penalties, and fines collected by the Commission ; and",
      "content": "(e) such other money or assets that may accrue to the Commission.",
      "page_start": 14,
      "page_end": 14,
      "content_length": 65
    },
    {
      "level": 1,
      "number": "20",
      "title": "—(1) There shall be chargeable to the Fund — Expenditure",
      "content": "of the Fund\n(a) the cost of administration of the Commission ;\n(b) allowances and remuneration payable to members of the Council ;\n(c) remunerations, allowances, retiring benefits, such as pensions and\ngratuities, and such other money payable to the staff of the Commission ;\n(d) the payment for consultancies and contracts, including mobilisation,\nfluctuations, variations, and legal fees ;\n(e) expenses necessary to meet capital expenditure, such as, for the\npurchase, acquisition, or maintenance o...",
      "page_start": 15,
      "page_end": 15,
      "content_length": 878
    },
    {
      "level": 1,
      "number": "21",
      "title": "—(1) Subject to any applicable law, the Commission may borrow Power to",
      "content": "such sums of money, as may be required in the performance of the functions borrow and\naccept gifts\nof the Commission under this Act.\n(2) The Commission may accept gifts, grants of money, aids, or other\nassets, provided that the terms and conditions of the acceptance are consistent\nwith the objectives and functions of the Commission under this Act.",
      "page_start": 15,
      "page_end": 15,
      "content_length": 349
    },
    {
      "level": 1,
      "number": "22",
      "title": "—(1) The Commission shall keep and maintain proper accounts and Account",
      "content": "records, including records of — and audit\n(a) receipts, payments, assets, and liabilities ; and\n(b) income and expenditure, in a form which conforms with existing\nlaws on accounts and audit.\n(2) The Commission shall cause the accounts to be audited, not later\nthan six months after the end of each year, by auditors appointed from the list\nmaintained by the Auditor-General for the Federation, and in accordance with\nthe guidelines provided by the Auditor-General for the Federation.",
      "page_start": 15,
      "page_end": 15,
      "content_length": 483
    },
    {
      "level": 3,
      "number": "3",
      "title": "50% of the total amount of the take-off grant shall be provided to the",
      "content": "Commission on the commencement of this Act, and the remaining 50% of the\ntake-off grant shall be provided on the anniversary of the date on which this\nAct commences.",
      "page_start": 15,
      "page_end": 15,
      "content_length": 165
    },
    {
      "level": 3,
      "number": "4",
      "title": "Subject to any applicable law, the Commission may borrow such",
      "content": "sums of money, as may be required in the performance of its functions under\nto this Act.\n20.—",
      "page_start": 15,
      "page_end": 15,
      "content_length": 93
    },
    {
      "level": 3,
      "number": "1",
      "title": "There shall be chargeable to the Fund — Expenditure",
      "content": "of the Fund",
      "page_start": 15,
      "page_end": 15,
      "content_length": 11
    },
    {
      "level": 3,
      "number": "a",
      "title": "the cost of administration of the Commission ;",
      "content": "",
      "page_start": 15,
      "page_end": 15,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "b",
      "title": "allowances and remuneration payable to members of the Council ;",
      "content": "",
      "page_start": 15,
      "page_end": 15,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "c",
      "title": "remunerations, allowances, retiring benefits, such as pensions and",
      "content": "gratuities, and such other money payable to the staff of the Commission ;",
      "page_start": 15,
      "page_end": 15,
      "content_length": 73
    },
    {
      "level": 3,
      "number": "d",
      "title": "the payment for consultancies and contracts, including mobilisation,",
      "content": "fluctuations, variations, and legal fees ;",
      "page_start": 15,
      "page_end": 15,
      "content_length": 42
    },
    {
      "level": 3,
      "number": "e",
      "title": "expenses necessary to meet capital expenditure, such as, for the",
      "content": "purchase, acquisition, or maintenance of property or other equipment of the\nCommission ;\n(f ) repayment of funds borrowed by the Commission, including interest\non such borrowed funds ; and",
      "page_start": 15,
      "page_end": 15,
      "content_length": 188
    },
    {
      "level": 3,
      "number": "g",
      "title": "any other expenditure, approved by the Council, for the purposes of",
      "content": "performing the functions of the Commission under this Act.",
      "page_start": 15,
      "page_end": 15,
      "content_length": 58
    },
    {
      "level": 3,
      "number": "2",
      "title": "The Fund of the Commission shall be managed in accordance with",
      "content": "the rules made by the Council.\n21.—",
      "page_start": 15,
      "page_end": 15,
      "content_length": 35
    },
    {
      "level": 3,
      "number": "1",
      "title": "Subject to any applicable law, the Commission may borrow Power to",
      "content": "such sums of money, as may be required in the performance of the functions borrow and\naccept gifts\nof the Commission under this Act.",
      "page_start": 15,
      "page_end": 15,
      "content_length": 132
    },
    {
      "level": 3,
      "number": "2",
      "title": "The Commission may accept gifts, grants of money, aids, or other",
      "content": "assets, provided that the terms and conditions of the acceptance are consistent\nwith the objectives and functions of the Commission under this Act.\n22.—",
      "page_start": 15,
      "page_end": 15,
      "content_length": 152
    },
    {
      "level": 3,
      "number": "1",
      "title": "The Commission shall keep and maintain proper accounts and Account",
      "content": "records, including records of — and audit",
      "page_start": 15,
      "page_end": 15,
      "content_length": 41
    },
    {
      "level": 3,
      "number": "a",
      "title": "receipts, payments, assets, and liabilities ; and",
      "content": "",
      "page_start": 15,
      "page_end": 15,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "b",
      "title": "income and expenditure, in a form which conforms with existing",
      "content": "laws on accounts and audit.",
      "page_start": 15,
      "page_end": 15,
      "content_length": 27
    },
    {
      "level": 3,
      "number": "2",
      "title": "The Commission shall cause the accounts to be audited, not later",
      "content": "than six months after the end of each year, by auditors appointed from the list\nmaintained by the Auditor-General for the Federation, and in accordance with\nthe guidelines provided by the Auditor-General for the Federation.",
      "page_start": 15,
      "page_end": 15,
      "content_length": 223
    },
    {
      "level": 1,
      "number": "23",
      "title": "—(1) The Commission shall, not later than six months after the end of",
      "content": "reports and each financial year, submit to the National Assembly through the Minister —\nestimates\n(a) a report of its activities during the preceding year, including the\naudited accounts of the Commission ; and\n(b) an estimate of the expenditure and income for the next succeeding\nyear.\n(2) Notwithstanding the provisions of subsection (1), the Commission\nmay, in any financial year, submit supplementary or adjusted statements of\nestimated income and expenditure to the National Assembly.\nPART V — P...",
      "page_start": 16,
      "page_end": 16,
      "content_length": 578
    },
    {
      "level": 1,
      "number": "24",
      "title": "—(1) A data controller or data processor shall ensure that personal",
      "content": "personal data is —\ndata\n(a) processed in a fair, lawful and transparent manner ;\nprocessing\n(b) collected for specified, explicit, and legitimate purposes, and not to\nbe further processed in a way incompatible with these purposes ;\n(c) adequate, relevant, and limited to the minimum necessary for the\npurposes for which the personal data was collected or further processed ;\n(d) retained for not longer than is necessary to achieve the lawful bases\nfor which the personal data was collected or furthe...",
      "page_start": 16,
      "page_end": 16,
      "content_length": 1327
    },
    {
      "level": 3,
      "number": "3",
      "title": "An auditor appointed under subsection",
      "content": "",
      "page_start": 16,
      "page_end": 16,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "2",
      "title": "shall have full and free",
      "content": "access to all account records, documents, and papers of the Commission.",
      "page_start": 16,
      "page_end": 16,
      "content_length": 71
    },
    {
      "level": 3,
      "number": "4",
      "title": "For the purpose of this section, the financial year of the Commission",
      "content": "shall be from 1 January to 31 December of every year, or such other period,\nas may be determined by the Council.\nAnnual 23.—",
      "page_start": 16,
      "page_end": 16,
      "content_length": 124
    },
    {
      "level": 3,
      "number": "1",
      "title": "The Commission shall, not later than six months after the end of",
      "content": "reports and each financial year, submit to the National Assembly through the Minister —\nestimates",
      "page_start": 16,
      "page_end": 16,
      "content_length": 97
    },
    {
      "level": 3,
      "number": "a",
      "title": "a report of its activities during the preceding year, including the",
      "content": "audited accounts of the Commission ; and",
      "page_start": 16,
      "page_end": 16,
      "content_length": 40
    },
    {
      "level": 3,
      "number": "b",
      "title": "an estimate of the expenditure and income for the next succeeding",
      "content": "year.",
      "page_start": 16,
      "page_end": 16,
      "content_length": 5
    },
    {
      "level": 3,
      "number": "2",
      "title": "Notwithstanding the provisions of subsection",
      "content": "",
      "page_start": 16,
      "page_end": 16,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "1",
      "title": ", the Commission",
      "content": "may, in any financial year, submit supplementary or adjusted statements of\nestimated income and expenditure to the National Assembly.\nPART V — PRINCIPLES AND LAWFUL BASIS GOVERNING\nPROCESSING OF PERSONAL DATA\nPrinciples of 24.—",
      "page_start": 16,
      "page_end": 16,
      "content_length": 227
    },
    {
      "level": 3,
      "number": "1",
      "title": "A data controller or data processor shall ensure that personal",
      "content": "personal data is —\ndata",
      "page_start": 16,
      "page_end": 16,
      "content_length": 23
    },
    {
      "level": 3,
      "number": "a",
      "title": "processed in a fair, lawful and transparent manner ;",
      "content": "processing",
      "page_start": 16,
      "page_end": 16,
      "content_length": 10
    },
    {
      "level": 3,
      "number": "b",
      "title": "collected for specified, explicit, and legitimate purposes, and not to",
      "content": "be further processed in a way incompatible with these purposes ;",
      "page_start": 16,
      "page_end": 16,
      "content_length": 64
    },
    {
      "level": 3,
      "number": "c",
      "title": "adequate, relevant, and limited to the minimum necessary for the",
      "content": "purposes for which the personal data was collected or further processed ;",
      "page_start": 16,
      "page_end": 16,
      "content_length": 73
    },
    {
      "level": 3,
      "number": "d",
      "title": "retained for not longer than is necessary to achieve the lawful bases",
      "content": "for which the personal data was collected or further processed ;",
      "page_start": 16,
      "page_end": 16,
      "content_length": 64
    },
    {
      "level": 3,
      "number": "e",
      "title": "accurate, complete, not misleading, and, where necessary, kept up",
      "content": "to date having regard to the purposes for which the personal data is collected\nor is further processed ; and\n(f ) processed in a manner that ensures appropriate security of personal\ndata, including protection against unauthorised or unlawful processing,\naccess, loss, destruction, damage, or any form of data breach.",
      "page_start": 16,
      "page_end": 16,
      "content_length": 316
    },
    {
      "level": 3,
      "number": "2",
      "title": "A data controller and data processor shall use appropriate technical",
      "content": "and organisational measures to ensure confidentiality, integrity, and availability\nof personal data.",
      "page_start": 16,
      "page_end": 16,
      "content_length": 100
    },
    {
      "level": 3,
      "number": "3",
      "title": "Notwithstanding anything to the contrary in this Act or any other",
      "content": "law, a data controller or data processor owes a duty of care, in respect of data\nprocessing, and shall demonstrate accountability, in respect of the principles\ncontained in this Act.",
      "page_start": 16,
      "page_end": 16,
      "content_length": 182
    },
    {
      "level": 1,
      "number": "25",
      "title": "—(1) Without prejudice to the principles set out in this Act, data Lawful basis",
      "content": "processing shall be lawful, where — of personal\ndata\n(a) the data subject has given and not withdrawn consent for the specific\nprocessing\npurpose or purposes for which personal data is to be processed ; or\n(b) the processing is necessary —\n(i) for the performance of a contract to which the data subject is a\nparty or to take steps at the request of the data subject prior to entering\ninto a contract,\n(ii) for compliance with a legal obligation to which the data controller\nor data processor is subj...",
      "page_start": 17,
      "page_end": 17,
      "content_length": 1329
    },
    {
      "level": 1,
      "number": "26",
      "title": "—(1) A data controller shall bear the burden of proof for establishing Consent",
      "content": "a data subject’s consent.",
      "page_start": 17,
      "page_end": 17,
      "content_length": 25
    },
    {
      "level": 3,
      "number": "4",
      "title": "For the purposes of subsection",
      "content": "",
      "page_start": 17,
      "page_end": 17,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "1",
      "title": "(b) —",
      "content": "",
      "page_start": 17,
      "page_end": 17,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "a",
      "title": "compatibility of further processing shall be assessed considering —",
      "content": "",
      "page_start": 17,
      "page_end": 17,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "i",
      "title": "the relationship between the original purpose and the purpose of",
      "content": "the intended further processing,\n(ii) the nature of the personal data concerned,\n(iii) the consequences of further processing,\n(iv) how the personal data has been collected, and",
      "page_start": 17,
      "page_end": 17,
      "content_length": 177
    },
    {
      "level": 3,
      "number": "v",
      "title": "the existence of appropriate safeguards ; and",
      "content": "",
      "page_start": 17,
      "page_end": 17,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "b",
      "title": "further processing for archiving purposes in the public interest,",
      "content": "scientific, historical research purposes, or statistical purposes shall not be\nconsidered to be incompatible with the initial purposes.\n25.—",
      "page_start": 17,
      "page_end": 17,
      "content_length": 140
    },
    {
      "level": 3,
      "number": "1",
      "title": "Without prejudice to the principles set out in this Act, data Lawful basis",
      "content": "processing shall be lawful, where — of personal\ndata",
      "page_start": 17,
      "page_end": 17,
      "content_length": 52
    },
    {
      "level": 3,
      "number": "a",
      "title": "the data subject has given and not withdrawn consent for the specific",
      "content": "processing\npurpose or purposes for which personal data is to be processed ; or",
      "page_start": 17,
      "page_end": 17,
      "content_length": 78
    },
    {
      "level": 3,
      "number": "b",
      "title": "the processing is necessary —",
      "content": "",
      "page_start": 17,
      "page_end": 17,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "i",
      "title": "for the performance of a contract to which the data subject is a",
      "content": "party or to take steps at the request of the data subject prior to entering\ninto a contract,\n(ii) for compliance with a legal obligation to which the data controller\nor data processor is subject,\n(iii) to protect the vital interest of the data subject or another person,\n(iv) for the performance of a task carried out in the public interest or\nin the exercise of official authority vested in the data controller or data\nprocessor, or",
      "page_start": 17,
      "page_end": 17,
      "content_length": 433
    },
    {
      "level": 3,
      "number": "v",
      "title": "for the purposes of the legitimate interests pursued by the data",
      "content": "controller or data processor, or by a third party to whom the data is\ndisclosed.",
      "page_start": 17,
      "page_end": 17,
      "content_length": 80
    },
    {
      "level": 3,
      "number": "2",
      "title": "Interests in personal data processing shall not be legitimate for the",
      "content": "purposes of subsection",
      "page_start": 17,
      "page_end": 17,
      "content_length": 22
    },
    {
      "level": 3,
      "number": "1",
      "title": "(b)",
      "content": "",
      "page_start": 17,
      "page_end": 17,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "v",
      "title": ", where —",
      "content": "",
      "page_start": 17,
      "page_end": 17,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "a",
      "title": "they override the fundamental rights, freedoms and the interests of",
      "content": "the data subject ;",
      "page_start": 17,
      "page_end": 17,
      "content_length": 18
    },
    {
      "level": 3,
      "number": "b",
      "title": "they are incompatible with other lawful basis of processing under",
      "content": "subsection",
      "page_start": 17,
      "page_end": 17,
      "content_length": 10
    },
    {
      "level": 3,
      "number": "1",
      "title": "(b)",
      "content": "",
      "page_start": 17,
      "page_end": 17,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "i",
      "title": "-(iv) ; or",
      "content": "",
      "page_start": 17,
      "page_end": 17,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "c",
      "title": "the data subject would not have a reasonable expectation that the",
      "content": "personal data would be processed in the manner envisaged.\n26.—",
      "page_start": 17,
      "page_end": 17,
      "content_length": 62
    },
    {
      "level": 3,
      "number": "1",
      "title": "A data controller shall bear the burden of proof for establishing Consent",
      "content": "a data subject’s consent.",
      "page_start": 17,
      "page_end": 17,
      "content_length": 25
    },
    {
      "level": 1,
      "number": "27",
      "title": "—(1) Before a data controller collects personal data directly from a",
      "content": "information data subject, the data controller shall inform the data subject of the —\nto the data\nsubject (a) identity, residence or place of business of, and means of\ncommunication with the data controller and its representatives, where\nnecessary ;\n(b) specific lawful basis of processing under section 25(1) or 30(1) of\nthis Act, and the purposes of the processing for which the personal data are\nintended ;\n(c) recipients or categories of recipients of the personal data, if any ;\n(d) existence of ...",
      "page_start": 18,
      "page_end": 18,
      "content_length": 1283
    },
    {
      "level": 3,
      "number": "2",
      "title": "In determining whether consent was freely and intentionally given,",
      "content": "account shall be taken of whether, the performance of a contract, including\nthe provision of a service, is conditional on consent to the processing of personal\ndata that is not necessary for the performance of that contract.",
      "page_start": 18,
      "page_end": 18,
      "content_length": 224
    },
    {
      "level": 3,
      "number": "3",
      "title": "Silence or inactivity of the data subject shall not constitute consent.",
      "content": "",
      "page_start": 18,
      "page_end": 18,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "4",
      "title": "Where the processing of personal data is based on the consent of",
      "content": "the data subject, the data subject shall be informed of the right to withdraw\nconsent, prior to the granting of consent.",
      "page_start": 18,
      "page_end": 18,
      "content_length": 120
    },
    {
      "level": 3,
      "number": "5",
      "title": "The withdrawal of consent under subsection",
      "content": "",
      "page_start": 18,
      "page_end": 18,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "4",
      "title": "shall not affect the",
      "content": "lawfulness of data processing that occurred before the withdrawal of the\nconsent.",
      "page_start": 18,
      "page_end": 18,
      "content_length": 81
    },
    {
      "level": 3,
      "number": "6",
      "title": "A request for consent shall be in clear and simple language and",
      "content": "accessible format.",
      "page_start": 18,
      "page_end": 18,
      "content_length": 18
    },
    {
      "level": 3,
      "number": "7",
      "title": "Consent —",
      "content": "",
      "page_start": 18,
      "page_end": 18,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "a",
      "title": "shall be in the affirmative, and not based on a pre-selected",
      "content": "confirmation ; and",
      "page_start": 18,
      "page_end": 18,
      "content_length": 18
    },
    {
      "level": 3,
      "number": "b",
      "title": "may be provided in writing, orally, or through electronic means.",
      "content": "Provision of 27.—",
      "page_start": 18,
      "page_end": 18,
      "content_length": 17
    },
    {
      "level": 3,
      "number": "1",
      "title": "Before a data controller collects personal data directly from a",
      "content": "information data subject, the data controller shall inform the data subject of the —\nto the data\nsubject",
      "page_start": 18,
      "page_end": 18,
      "content_length": 104
    },
    {
      "level": 3,
      "number": "a",
      "title": "identity, residence or place of business of, and means of",
      "content": "communication with the data controller and its representatives, where\nnecessary ;",
      "page_start": 18,
      "page_end": 18,
      "content_length": 81
    },
    {
      "level": 3,
      "number": "b",
      "title": "specific lawful basis of processing under section 25",
      "content": "",
      "page_start": 18,
      "page_end": 18,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "1",
      "title": "or 30",
      "content": "",
      "page_start": 18,
      "page_end": 18,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "1",
      "title": "of",
      "content": "this Act, and the purposes of the processing for which the personal data are\nintended ;",
      "page_start": 18,
      "page_end": 18,
      "content_length": 87
    },
    {
      "level": 3,
      "number": "c",
      "title": "recipients or categories of recipients of the personal data, if any ;",
      "content": "",
      "page_start": 18,
      "page_end": 18,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "d",
      "title": "existence of the rights of the data subject under Part VI ;",
      "content": "",
      "page_start": 18,
      "page_end": 18,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "e",
      "title": "retention period for the personal data ;",
      "content": "(f ) right to lodge a complaint with the Commission in accordance with\nsection 46",
      "page_start": 18,
      "page_end": 18,
      "content_length": 81
    },
    {
      "level": 3,
      "number": "1",
      "title": "of this Act ; and",
      "content": "",
      "page_start": 18,
      "page_end": 18,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "g",
      "title": "existence of automated decision-making, including profiling, the",
      "content": "significance and envisaged consequences of such processing for the data\nsubject, and the right to object to and challenge such processing.",
      "page_start": 18,
      "page_end": 18,
      "content_length": 138
    },
    {
      "level": 3,
      "number": "2",
      "title": "Before a data controller collects personal data, other than directly",
      "content": "from the data subject, the data controller shall inform the data subject of the\nmatters set out in subsection",
      "page_start": 18,
      "page_end": 18,
      "content_length": 109
    },
    {
      "level": 3,
      "number": "1",
      "title": ", except where the —",
      "content": "",
      "page_start": 18,
      "page_end": 18,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "a",
      "title": "data subject already has been provided with such information ; or",
      "content": "",
      "page_start": 18,
      "page_end": 18,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "b",
      "title": "provision of such information is impossible or would involve a",
      "content": "disproportionate effort or expense.",
      "page_start": 18,
      "page_end": 18,
      "content_length": 35
    },
    {
      "level": 1,
      "number": "28",
      "title": "—(1) Where the processing of personal data may likely result in Data privacy",
      "content": "high risk to the rights and freedoms of a data subject by virtue of its nature, impact\nassessment.\nscope, context, and purposes, a data controller shall, prior to the processing,\ncarry out a data privacy impact assessment.\n(2) The data controller shall consult the Commission prior to the processing\nif, notwithstanding the measures envisaged under this section, the data\nprotection impact assessment indicates that the processing of the data would\nresult in a high risk to the rights and freedoms of...",
      "page_start": 19,
      "page_end": 19,
      "content_length": 1571
    },
    {
      "level": 1,
      "number": "29",
      "title": "—(1) Where a data controller engages the services of a data Obligations",
      "content": "processor, or a data processor engages the services of another data processor, of the data\ncontroller\nthe data controller or data processor engaging another shall ensure that the\nand data\nengaged data processor —\nprocessor\n(a) complies with the principles and obligations set out in this Act as\napplicable to the data controller ;\n(b) assists the data controller or data processor, as the case may be, by\nthe use of appropriate technical and organisational measures, in the fulfilment\nof the data con...",
      "page_start": 19,
      "page_end": 19,
      "content_length": 576
    },
    {
      "level": 3,
      "number": "3",
      "title": "The information referred to in subsection",
      "content": "",
      "page_start": 19,
      "page_end": 19,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "1",
      "title": "shall be contained in a",
      "content": "privacy policy and expressed in clear, concise, transparent, intelligible, and\neasily accessible format, taking into consideration the class of data subjects\ntargeted by the data processing.\n28.—",
      "page_start": 19,
      "page_end": 19,
      "content_length": 195
    },
    {
      "level": 3,
      "number": "1",
      "title": "Where the processing of personal data may likely result in Data privacy",
      "content": "high risk to the rights and freedoms of a data subject by virtue of its nature, impact\nassessment.\nscope, context, and purposes, a data controller shall, prior to the processing,\ncarry out a data privacy impact assessment.",
      "page_start": 19,
      "page_end": 19,
      "content_length": 222
    },
    {
      "level": 3,
      "number": "2",
      "title": "The data controller shall consult the Commission prior to the processing",
      "content": "if, notwithstanding the measures envisaged under this section, the data\nprotection impact assessment indicates that the processing of the data would\nresult in a high risk to the rights and freedoms of a data subject.",
      "page_start": 19,
      "page_end": 19,
      "content_length": 216
    },
    {
      "level": 3,
      "number": "3",
      "title": "The Commission may make regulations or issue directives with",
      "content": "regards to this section, including the categories of processing and persons\nsubject to the requirement for the conduct of a data privacy impact assessment.",
      "page_start": 19,
      "page_end": 19,
      "content_length": 155
    },
    {
      "level": 3,
      "number": "4",
      "title": "For purposes of this section, a “data privacy impact assessment” is",
      "content": "a process designed to identify the risks and impact of the envisaged processing\nof personal data, and it comprises —",
      "page_start": 19,
      "page_end": 19,
      "content_length": 116
    },
    {
      "level": 3,
      "number": "a",
      "title": "a systematic description of the envisaged processing and its purpose,",
      "content": "including the legitimate interest pursued by the data controller, data processor,\nor third party ;",
      "page_start": 19,
      "page_end": 19,
      "content_length": 98
    },
    {
      "level": 3,
      "number": "b",
      "title": "an assessment of the necessity and proportionality of the processing",
      "content": "in relation to the purposes for which the personal data would be processed ;",
      "page_start": 19,
      "page_end": 19,
      "content_length": 76
    },
    {
      "level": 3,
      "number": "c",
      "title": "an assessment of the risks to the rights and freedoms of a data",
      "content": "subject ; and",
      "page_start": 19,
      "page_end": 19,
      "content_length": 13
    },
    {
      "level": 3,
      "number": "d",
      "title": "the measures envisaged to address the risks, safeguards, security",
      "content": "measures and mechanisms to ensure the protection of personal data, taking\ninto account the rights and legitimate interests of a data subject and other\npersons concerned.\n29.—",
      "page_start": 19,
      "page_end": 19,
      "content_length": 174
    },
    {
      "level": 3,
      "number": "1",
      "title": "Where a data controller engages the services of a data Obligations",
      "content": "processor, or a data processor engages the services of another data processor, of the data\ncontroller\nthe data controller or data processor engaging another shall ensure that the\nand data\nengaged data processor —\nprocessor",
      "page_start": 19,
      "page_end": 19,
      "content_length": 222
    },
    {
      "level": 3,
      "number": "a",
      "title": "complies with the principles and obligations set out in this Act as",
      "content": "applicable to the data controller ;",
      "page_start": 19,
      "page_end": 19,
      "content_length": 35
    },
    {
      "level": 3,
      "number": "b",
      "title": "assists the data controller or data processor, as the case may be, by",
      "content": "the use of appropriate technical and organisational measures, in the fulfilment\nof the data controller’s obligations to honour the rights of a data subject\nunder Part VI ;",
      "page_start": 19,
      "page_end": 19,
      "content_length": 171
    },
    {
      "level": 1,
      "number": "30",
      "title": "—(1) Without prejudice to the principles set out in this Act, a data",
      "content": "personal controller or data processor shall not process, or permit a data processor to\ndata\nprocess on its behalf, sensitive personal data, unless the —\n(a) data subject has given and not withdrawn consent to the processing\nfor the specific purpose or purposes for which it will be processed ;\n(b) processing is necessary for the purposes of performing the\nobligations of the data controller or exercising rights of the data subject\nunder employment or social security laws or any other similar laws ...",
      "page_start": 20,
      "page_end": 20,
      "content_length": 1875
    },
    {
      "level": 3,
      "number": "c",
      "title": "implements appropriate technical and organisational measures to",
      "content": "ensure the security, integrity, and confidentiality of personal data as required\nin Part VII ;",
      "page_start": 20,
      "page_end": 20,
      "content_length": 94
    },
    {
      "level": 3,
      "number": "d",
      "title": "provides the data controller or engaging data processor, where",
      "content": "applicable, with information reasonably required to comply and demonstrate\ncompliance with this Act ; and",
      "page_start": 20,
      "page_end": 20,
      "content_length": 105
    },
    {
      "level": 3,
      "number": "e",
      "title": "notifies the data controller or engaging data processor, where",
      "content": "applicable, when a new data processor is engaged.",
      "page_start": 20,
      "page_end": 20,
      "content_length": 49
    },
    {
      "level": 3,
      "number": "2",
      "title": "The measures under subsection",
      "content": "",
      "page_start": 20,
      "page_end": 20,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "1",
      "title": "include a written agreement",
      "content": "between the data controllers and the data processor, or between data\nprocessors, as the case may be.\nSensitive 30.—",
      "page_start": 20,
      "page_end": 20,
      "content_length": 115
    },
    {
      "level": 3,
      "number": "1",
      "title": "Without prejudice to the principles set out in this Act, a data",
      "content": "personal controller or data processor shall not process, or permit a data processor to\ndata\nprocess on its behalf, sensitive personal data, unless the —",
      "page_start": 20,
      "page_end": 20,
      "content_length": 152
    },
    {
      "level": 3,
      "number": "a",
      "title": "data subject has given and not withdrawn consent to the processing",
      "content": "for the specific purpose or purposes for which it will be processed ;",
      "page_start": 20,
      "page_end": 20,
      "content_length": 69
    },
    {
      "level": 3,
      "number": "b",
      "title": "processing is necessary for the purposes of performing the",
      "content": "obligations of the data controller or exercising rights of the data subject\nunder employment or social security laws or any other similar laws ;",
      "page_start": 20,
      "page_end": 20,
      "content_length": 144
    },
    {
      "level": 3,
      "number": "c",
      "title": "processing is necessary to protect the vital interests of the data",
      "content": "subject or of another person, where the data subject is physically or legally\nincapable of giving consent ;",
      "page_start": 20,
      "page_end": 20,
      "content_length": 107
    },
    {
      "level": 3,
      "number": "d",
      "title": "processing is carried out in the course of its legitimate activities,",
      "content": "with appropriate safeguards, by a foundation, association, or such other\nnon-profit organisation with charitable, educational, literary, artistic,\nphilosophical, religious, or trade union purposes, and the —",
      "page_start": 20,
      "page_end": 20,
      "content_length": 207
    },
    {
      "level": 3,
      "number": "i",
      "title": "processing relates solely to the members or former members of",
      "content": "the entity, or to persons, who have regular contact with it in connection\nwith its purposes, and\n(ii) sensitive personal data is not disclosed outside of the entity without\nthe explicit consent of the data subject ;",
      "page_start": 20,
      "page_end": 20,
      "content_length": 215
    },
    {
      "level": 3,
      "number": "e",
      "title": "processing is necessary for the establishment, exercise, or defense",
      "content": "of a legal claim, obtaining legal advice, or conduct of a legal proceeding ;\n(f ) processing is necessary for reasons of substantial public interest, on\nthe basis of a law, which shall be proportionate to the aim pursued, and\nprovides for suitable and specific measures to safeguard the fundamental\nrights, freedoms and interests of the data subject ;",
      "page_start": 20,
      "page_end": 20,
      "content_length": 351
    },
    {
      "level": 3,
      "number": "g",
      "title": "processing is carried out for purposes of medical care or community",
      "content": "welfare, and undertaken by or under the responsibility of a professional or\nsimilar service provider owing a duty of confidentiality ;",
      "page_start": 20,
      "page_end": 20,
      "content_length": 134
    },
    {
      "level": 1,
      "number": "31",
      "title": "—(1) Where a data subject is a child or a person lacking the legal Children or",
      "content": "capacity to consent, a data controller shall obtain the consent of the parent or persons\nlegal guardian, as applicable, to rely on consent under this Act. lacking the\nlegal\n(2) A data controller shall apply appropriate mechanisms to verify age capacity to\nand consent, taking into consideration available technology. consent\n(3) For the purposes of subsection (2), presentation of any government\napproved identification documents shall be an appropriate mechanism.\n(4) subsection (1) shall not apply,...",
      "page_start": 21,
      "page_end": 21,
      "content_length": 1207
    },
    {
      "level": 3,
      "number": "h",
      "title": "processing is necessary for reasons of public health and provides",
      "content": "for suitable and specific measures to safeguard the fundamental rights,\nfreedoms and interests of the data subject ; or",
      "page_start": 21,
      "page_end": 21,
      "content_length": 119
    },
    {
      "level": 3,
      "number": "i",
      "title": "processing is necessary for archiving purposes in the public interest,",
      "content": "or historical, statistical, or scientific research, in each case on the basis of a\nlaw, which shall be proportionate to the aim pursued, and provides for suitable\nand specific measures to safeguard the fundamental rights and freedoms\nand the interests of the data subject.",
      "page_start": 21,
      "page_end": 21,
      "content_length": 272
    },
    {
      "level": 3,
      "number": "2",
      "title": "The Commission may make regulations or issue directives",
      "content": "prescribing —",
      "page_start": 21,
      "page_end": 21,
      "content_length": 13
    },
    {
      "level": 3,
      "number": "a",
      "title": "further categories of personal data that may be classified as sensitive",
      "content": "personal data ;",
      "page_start": 21,
      "page_end": 21,
      "content_length": 15
    },
    {
      "level": 3,
      "number": "b",
      "title": "further grounds on which such personal data may be processed ; and",
      "content": "",
      "page_start": 21,
      "page_end": 21,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "c",
      "title": "safeguards that may apply.",
      "content": "",
      "page_start": 21,
      "page_end": 21,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "3",
      "title": "The Commission shall, in making regulations or issuing directives",
      "content": "under subsection",
      "page_start": 21,
      "page_end": 21,
      "content_length": 16
    },
    {
      "level": 3,
      "number": "2",
      "title": ", have regard to the —",
      "content": "",
      "page_start": 21,
      "page_end": 21,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "a",
      "title": "risk of significant harm that may be caused to a data subject or a class",
      "content": "of data subjects by the processing of such category of personal data ;",
      "page_start": 21,
      "page_end": 21,
      "content_length": 70
    },
    {
      "level": 3,
      "number": "b",
      "title": "reasonable expectation of confidentiality attached to such category",
      "content": "of personal data ; and",
      "page_start": 21,
      "page_end": 21,
      "content_length": 22
    },
    {
      "level": 3,
      "number": "c",
      "title": "adequacy of protection afforded to personal data generally.",
      "content": "31.—",
      "page_start": 21,
      "page_end": 21,
      "content_length": 4
    },
    {
      "level": 3,
      "number": "1",
      "title": "Where a data subject is a child or a person lacking the legal Children or",
      "content": "capacity to consent, a data controller shall obtain the consent of the parent or persons\nlegal guardian, as applicable, to rely on consent under this Act. lacking the\nlegal",
      "page_start": 21,
      "page_end": 21,
      "content_length": 172
    },
    {
      "level": 3,
      "number": "2",
      "title": "A data controller shall apply appropriate mechanisms to verify age capacity to",
      "content": "and consent, taking into consideration available technology. consent",
      "page_start": 21,
      "page_end": 21,
      "content_length": 68
    },
    {
      "level": 3,
      "number": "3",
      "title": "For the purposes of subsection",
      "content": "",
      "page_start": 21,
      "page_end": 21,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "2",
      "title": ", presentation of any government",
      "content": "approved identification documents shall be an appropriate mechanism.",
      "page_start": 21,
      "page_end": 21,
      "content_length": 68
    },
    {
      "level": 3,
      "number": "4",
      "title": "subsection",
      "content": "",
      "page_start": 21,
      "page_end": 21,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "1",
      "title": "shall not apply, where the processing is —",
      "content": "",
      "page_start": 21,
      "page_end": 21,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "a",
      "title": "necessary to protect the vital interests of the child or person lacking",
      "content": "the legal capacity to consent ;",
      "page_start": 21,
      "page_end": 21,
      "content_length": 31
    },
    {
      "level": 3,
      "number": "b",
      "title": "carried out for purposes of education, medical, or social care, and",
      "content": "undertaken by or under the responsibility of a professional or similar service\nprovider owing a duty of confidentiality ; or",
      "page_start": 21,
      "page_end": 21,
      "content_length": 124
    },
    {
      "level": 3,
      "number": "c",
      "title": "necessary for proceedings before a court relating to the individual.",
      "content": "",
      "page_start": 21,
      "page_end": 21,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "5",
      "title": "Where the circumstance relates to the processing of personal data",
      "content": "of a child of 13 years and above in relation to the provision of information and\nservices by electronic means at the specific request of the child, the Commission\nshall make regulations in accordance with the objectives of this Act.",
      "page_start": 21,
      "page_end": 21,
      "content_length": 232
    },
    {
      "level": 1,
      "number": "32",
      "title": "—(1) A data controller of major importance shall designate a Data",
      "content": "Protection Protection Officer with expert knowledge of data protection law and practices,\nOfficers\nand the ability to carry out the tasks prescribed under this Act and subsidiary\nlegislation made under it.\n(2) The Data Protection Officer may be an employee of a data controller\nor engaged by a service contract.\n(3) The Data Protection Officer shall —\n(a) advise the data controller or the data processor, and their employees,\nwho carry out processing made under this Act ;\n(b) monitor compliance wit...",
      "page_start": 22,
      "page_end": 22,
      "content_length": 670
    },
    {
      "level": 1,
      "number": "33",
      "title": "The Commission may license a person having a requisite level of",
      "content": "protection expertise, in relation to data protection and this Act, to monitor, audit and\ncompliance report on compliance by data controllers and data processors with —\nservices\n(a) this Act ; and\n(b) regulations, guidelines, directives, and codes of conduct issued by\nthe Commission made under the provisions of this Act.\nPART VI — RIGHTS OF A DATA SUBJECT\nRights of a",
      "page_start": 22,
      "page_end": 22,
      "content_length": 368
    },
    {
      "level": 1,
      "number": "34",
      "title": "—(1) A data subject has the right to obtain from a data controller,",
      "content": "data subject without constraint or unreasonable delay —\n(a) confirmation as to whether the data controller or a data processor\noperating on its behalf, is storing or otherwise processing personal data\nrelating to the data subject, and where that is the case —\n(i)the purposes of the processing,\n(ii) the categories of personal data concerned,\n(iii) the recipients or categories of recipient to whom the personal data\nhave been or will be disclosed, particularly recipients in third countries or\ninter...",
      "page_start": 22,
      "page_end": 22,
      "content_length": 881
    },
    {
      "level": 3,
      "number": "6",
      "title": "Nothing in this Act shall be construed as authorising data processing",
      "content": "2003 in respect of a child in a manner that is inconsistent with the provisions of the\nChild’s Right Act.\nData 32.—",
      "page_start": 22,
      "page_end": 22,
      "content_length": 115
    },
    {
      "level": 3,
      "number": "1",
      "title": "A data controller of major importance shall designate a Data",
      "content": "Protection Protection Officer with expert knowledge of data protection law and practices,\nOfficers\nand the ability to carry out the tasks prescribed under this Act and subsidiary\nlegislation made under it.",
      "page_start": 22,
      "page_end": 22,
      "content_length": 205
    },
    {
      "level": 3,
      "number": "2",
      "title": "The Data Protection Officer may be an employee of a data controller",
      "content": "or engaged by a service contract.",
      "page_start": 22,
      "page_end": 22,
      "content_length": 33
    },
    {
      "level": 3,
      "number": "3",
      "title": "The Data Protection Officer shall —",
      "content": "",
      "page_start": 22,
      "page_end": 22,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "a",
      "title": "advise the data controller or the data processor, and their employees,",
      "content": "who carry out processing made under this Act ;",
      "page_start": 22,
      "page_end": 22,
      "content_length": 46
    },
    {
      "level": 3,
      "number": "b",
      "title": "monitor compliance with this Act and related policies of the data",
      "content": "controller or data processor ; and",
      "page_start": 22,
      "page_end": 22,
      "content_length": 34
    },
    {
      "level": 3,
      "number": "c",
      "title": "act as the contact point for the Commission on issues relating to data",
      "content": "processing.\nData 33. The Commission may license a person having a requisite level of\nprotection expertise, in relation to data protection and this Act, to monitor, audit and\ncompliance report on compliance by data controllers and data processors with —\nservices",
      "page_start": 22,
      "page_end": 22,
      "content_length": 261
    },
    {
      "level": 3,
      "number": "a",
      "title": "this Act ; and",
      "content": "",
      "page_start": 22,
      "page_end": 22,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "b",
      "title": "regulations, guidelines, directives, and codes of conduct issued by",
      "content": "the Commission made under the provisions of this Act.\nPART VI — RIGHTS OF A DATA SUBJECT\nRights of a 34.—",
      "page_start": 22,
      "page_end": 22,
      "content_length": 105
    },
    {
      "level": 3,
      "number": "1",
      "title": "A data subject has the right to obtain from a data controller,",
      "content": "data subject without constraint or unreasonable delay —",
      "page_start": 22,
      "page_end": 22,
      "content_length": 55
    },
    {
      "level": 3,
      "number": "a",
      "title": "confirmation as to whether the data controller or a data processor",
      "content": "operating on its behalf, is storing or otherwise processing personal data\nrelating to the data subject, and where that is the case —",
      "page_start": 22,
      "page_end": 22,
      "content_length": 132
    },
    {
      "level": 3,
      "number": "i",
      "title": "the purposes of the processing,",
      "content": "(ii) the categories of personal data concerned,\n(iii) the recipients or categories of recipient to whom the personal data\nhave been or will be disclosed, particularly recipients in third countries or\ninternational organisations,\n(iv) where possible, the period for which the personal data will be stored,\nor, if not possible, the criteria used to determine that period,",
      "page_start": 22,
      "page_end": 22,
      "content_length": 369
    },
    {
      "level": 3,
      "number": "v",
      "title": "the existence of the right to request from the data controller",
      "content": "rectification or erasure of personal data, or restriction of processing of\npersonal data concerning the data subject or to object to such processing,",
      "page_start": 22,
      "page_end": 22,
      "content_length": 149
    },
    {
      "level": 1,
      "number": "35",
      "title": "—(1) A data subject shall have the right to withdraw, at any time, Withdrawal",
      "content": "consent to the processing of personal data under this Act. of consent\n(2) The data controller shall ensure that it is as easy for the data subject\nto withdraw, as to give consent.",
      "page_start": 23,
      "page_end": 23,
      "content_length": 179
    },
    {
      "level": 1,
      "number": "36",
      "title": "—(1) A data subject shall have the right to object to the processing Right to",
      "content": "of personal data relating to the data subject. object\n(2) A data controller shall discontinue the processing of personal data,\nunless the data controller demonstrates a public interest or other legitimate\ngrounds, which overrides the fundamental rights and freedoms, and the interests\nof the data subject.\n(3) Where personal data is processed for direct marketing purposes, the\ndata subject shall have the right to object, at any time, to the processing of\npersonal data concerning the data subject, ...",
      "page_start": 23,
      "page_end": 23,
      "content_length": 583
    },
    {
      "level": 3,
      "number": "b",
      "title": "a copy of data subject’s personal data in a commonly used electronic",
      "content": "format, except to the extent that providing such data would impose\nunreasonable costs on the data controller, in which case the data subject\nmay be required by the data controller to bear some or all of such costs ;",
      "page_start": 23,
      "page_end": 23,
      "content_length": 215
    },
    {
      "level": 3,
      "number": "c",
      "title": "the correction or, if correction is not feasible or suitable, deletion of",
      "content": "the data subject’s personal data that is inaccurate, out of date, incomplete,\nor misleading ;",
      "page_start": 23,
      "page_end": 23,
      "content_length": 93
    },
    {
      "level": 3,
      "number": "d",
      "title": "the erasure of personal data concerning the data subject, without",
      "content": "undue delay ; and",
      "page_start": 23,
      "page_end": 23,
      "content_length": 17
    },
    {
      "level": 3,
      "number": "e",
      "title": "restriction of data processing pending —",
      "content": "",
      "page_start": 23,
      "page_end": 23,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "i",
      "title": "the resolution of a request,",
      "content": "(ii) objection by the data subject under this Act, or\n(iii) the establishment, exercise, or defense of legal claims.",
      "page_start": 23,
      "page_end": 23,
      "content_length": 116
    },
    {
      "level": 3,
      "number": "2",
      "title": "A data controller shall erase personal data without undue delay,",
      "content": "where —",
      "page_start": 23,
      "page_end": 23,
      "content_length": 7
    },
    {
      "level": 3,
      "number": "a",
      "title": "the personal data is no longer necessary, in relation to the purposes",
      "content": "for which it was collected or processed, or",
      "page_start": 23,
      "page_end": 23,
      "content_length": 43
    },
    {
      "level": 3,
      "number": "b",
      "title": "the data controller has no other lawful basis to retain the personal",
      "content": "data.\n35.—",
      "page_start": 23,
      "page_end": 23,
      "content_length": 10
    },
    {
      "level": 3,
      "number": "1",
      "title": "A data subject shall have the right to withdraw, at any time, Withdrawal",
      "content": "consent to the processing of personal data under this Act. of consent",
      "page_start": 23,
      "page_end": 23,
      "content_length": 69
    },
    {
      "level": 3,
      "number": "2",
      "title": "The data controller shall ensure that it is as easy for the data subject",
      "content": "to withdraw, as to give consent.\n36.—",
      "page_start": 23,
      "page_end": 23,
      "content_length": 37
    },
    {
      "level": 3,
      "number": "1",
      "title": "A data subject shall have the right to object to the processing Right to",
      "content": "of personal data relating to the data subject. object",
      "page_start": 23,
      "page_end": 23,
      "content_length": 53
    },
    {
      "level": 3,
      "number": "2",
      "title": "A data controller shall discontinue the processing of personal data,",
      "content": "unless the data controller demonstrates a public interest or other legitimate\ngrounds, which overrides the fundamental rights and freedoms, and the interests\nof the data subject.",
      "page_start": 23,
      "page_end": 23,
      "content_length": 178
    },
    {
      "level": 3,
      "number": "3",
      "title": "Where personal data is processed for direct marketing purposes, the",
      "content": "data subject shall have the right to object, at any time, to the processing of\npersonal data concerning the data subject, which includes profiling to the extent\nthat it is related to such direct marketing.",
      "page_start": 23,
      "page_end": 23,
      "content_length": 205
    },
    {
      "level": 1,
      "number": "37",
      "title": "—(1) A data subject shall have the right not to be subject to a decision",
      "content": "decision based solely on automated processing of personal data, including profiling,\nmaking\nwhich produces legal or similar significant effects concerning the data subject.\n(2) Subsection (1) shall not apply, where the decision is —\n(a) necessary for entering into or the performance of a contract between\nthe data subject and a data controller ;\n(b) authorised by a written law, which establishes suitable measures to\nsafeguard the fundamental rights and freedoms, and the interests of the\ndata subj...",
      "page_start": 24,
      "page_end": 24,
      "content_length": 868
    },
    {
      "level": 1,
      "number": "38",
      "title": "—(1) The Commission may make regulations establishing a right of",
      "content": "portability personal data portability.\n(2) Right of data portability under this Act shall entitle the data\nsubject to —\n(a) receive, without undue delay from a data controller, personal data\nconcerning the data subject in a structured, commonly used, and machine-\nreadable format ;\n(b) transmit the personal data obtained under paragraph (a) to another\ndata controller without any hindrance ; and\n(c) where technically possible, have the personal data transmitted directly\nfrom one data controller to...",
      "page_start": 24,
      "page_end": 24,
      "content_length": 825
    },
    {
      "level": 3,
      "number": "4",
      "title": "Where the data subject objects to processing for direct marketing",
      "content": "purposes, the personal data shall no longer be processed for such purposes.\nAutomated 37.—",
      "page_start": 24,
      "page_end": 24,
      "content_length": 90
    },
    {
      "level": 3,
      "number": "1",
      "title": "A data subject shall have the right not to be subject to a decision",
      "content": "decision based solely on automated processing of personal data, including profiling,\nmaking\nwhich produces legal or similar significant effects concerning the data subject.",
      "page_start": 24,
      "page_end": 24,
      "content_length": 172
    },
    {
      "level": 3,
      "number": "2",
      "title": "Subsection",
      "content": "",
      "page_start": 24,
      "page_end": 24,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "1",
      "title": "shall not apply, where the decision is —",
      "content": "",
      "page_start": 24,
      "page_end": 24,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "a",
      "title": "necessary for entering into or the performance of a contract between",
      "content": "the data subject and a data controller ;",
      "page_start": 24,
      "page_end": 24,
      "content_length": 40
    },
    {
      "level": 3,
      "number": "b",
      "title": "authorised by a written law, which establishes suitable measures to",
      "content": "safeguard the fundamental rights and freedoms, and the interests of the\ndata subject ; or",
      "page_start": 24,
      "page_end": 24,
      "content_length": 89
    },
    {
      "level": 3,
      "number": "c",
      "title": "authorised by the consent of the data subject.",
      "content": "",
      "page_start": 24,
      "page_end": 24,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "3",
      "title": "The data controller shall implement suitable measures to safeguard",
      "content": "the data subject’s fundamental rights, freedoms and interests, including the\nrights to —",
      "page_start": 24,
      "page_end": 24,
      "content_length": 88
    },
    {
      "level": 3,
      "number": "a",
      "title": "obtain human intervention on the part of the data controller ;",
      "content": "",
      "page_start": 24,
      "page_end": 24,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "b",
      "title": "express the data subject’s point of view ; and",
      "content": "",
      "page_start": 24,
      "page_end": 24,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "c",
      "title": "contest the decision.",
      "content": "Data 38.—",
      "page_start": 24,
      "page_end": 24,
      "content_length": 9
    },
    {
      "level": 3,
      "number": "1",
      "title": "The Commission may make regulations establishing a right of",
      "content": "portability personal data portability.",
      "page_start": 24,
      "page_end": 24,
      "content_length": 38
    },
    {
      "level": 3,
      "number": "2",
      "title": "Right of data portability under this Act shall entitle the data",
      "content": "subject to —",
      "page_start": 24,
      "page_end": 24,
      "content_length": 12
    },
    {
      "level": 3,
      "number": "a",
      "title": "receive, without undue delay from a data controller, personal data",
      "content": "concerning the data subject in a structured, commonly used, and machine-\nreadable format ;",
      "page_start": 24,
      "page_end": 24,
      "content_length": 90
    },
    {
      "level": 3,
      "number": "b",
      "title": "transmit the personal data obtained under paragraph",
      "content": "",
      "page_start": 24,
      "page_end": 24,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "a",
      "title": "to another",
      "content": "data controller without any hindrance ; and",
      "page_start": 24,
      "page_end": 24,
      "content_length": 43
    },
    {
      "level": 3,
      "number": "c",
      "title": "where technically possible, have the personal data transmitted directly",
      "content": "from one data controller to another.",
      "page_start": 24,
      "page_end": 24,
      "content_length": 36
    },
    {
      "level": 3,
      "number": "3",
      "title": "The Commission may prescribe —",
      "content": "",
      "page_start": 24,
      "page_end": 24,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "a",
      "title": "circumstances and conditions on which the data subject may exercise",
      "content": "the right of data portability ; and",
      "page_start": 24,
      "page_end": 24,
      "content_length": 35
    },
    {
      "level": 3,
      "number": "b",
      "title": "the obligations it would impose on a data controller or data processor,",
      "content": "or categories of data controllers or data processors, including in relation to\ncosts and timing.",
      "page_start": 24,
      "page_end": 24,
      "content_length": 96
    },
    {
      "level": 1,
      "number": "39",
      "title": "—(1) A data controller and data processor shall implement appropriate",
      "content": "Security,\ntechnical and organisational measures to ensure the security, integrity and\nintegrity,\nconfidentiality of personal data in its possession or under its control, including\na n d\nprotections against accidental or unlawful destruction, loss, misuse, alteration,\nconfidentiality\nunauthorised disclosure, or access, taking into account —\n(a) the amount and sensitivity of the personal data ;\n(b) the nature, degree and likelihood of harm to a data subject that could\nresult from the loss, disclos...",
      "page_start": 25,
      "page_end": 25,
      "content_length": 1685
    },
    {
      "level": 1,
      "number": "40",
      "title": "—(1) Where a personal data breach has occurred with respect to Personal",
      "content": "personal data being stored or processed by a data processor, the data processor data\nshall, on becoming aware of the breach — breaches\n(a) notify the data controller or data processor that engaged it,\ndescribing the nature of the personal data breach including, where possible,\nthe categories and approximate numbers of data subjects and personal\ndata records concerned ; and\n(b) respond to all information requests from the data controller or data\nprocessor that engaged it, as they may require to c...",
      "page_start": 25,
      "page_end": 25,
      "content_length": 548
    },
    {
      "level": 3,
      "number": "1",
      "title": "A data controller and data processor shall implement appropriate",
      "content": "Security,\ntechnical and organisational measures to ensure the security, integrity and\nintegrity,\nconfidentiality of personal data in its possession or under its control, including\na n d\nprotections against accidental or unlawful destruction, loss, misuse, alteration,\nconfidentiality\nunauthorised disclosure, or access, taking into account —",
      "page_start": 25,
      "page_end": 25,
      "content_length": 341
    },
    {
      "level": 3,
      "number": "a",
      "title": "the amount and sensitivity of the personal data ;",
      "content": "",
      "page_start": 25,
      "page_end": 25,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "b",
      "title": "the nature, degree and likelihood of harm to a data subject that could",
      "content": "result from the loss, disclosure, or other misuse of the personal data ;",
      "page_start": 25,
      "page_end": 25,
      "content_length": 72
    },
    {
      "level": 3,
      "number": "c",
      "title": "the extent of the processing ;",
      "content": "",
      "page_start": 25,
      "page_end": 25,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "d",
      "title": "the period of data retention ; and",
      "content": "",
      "page_start": 25,
      "page_end": 25,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "e",
      "title": "the availability and cost of any technologies, tools, or other measures",
      "content": "to be implemented relative to the size of the data controller or data processor.",
      "page_start": 25,
      "page_end": 25,
      "content_length": 80
    },
    {
      "level": 3,
      "number": "2",
      "title": "Measures implemented under subsection",
      "content": "",
      "page_start": 25,
      "page_end": 25,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "1",
      "title": "may include —",
      "content": "",
      "page_start": 25,
      "page_end": 25,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "a",
      "title": "pseudonymisation or other methods of de-identification of personal",
      "content": "data ;",
      "page_start": 25,
      "page_end": 25,
      "content_length": 6
    },
    {
      "level": 3,
      "number": "b",
      "title": "encryption of personal data ;",
      "content": "",
      "page_start": 25,
      "page_end": 25,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "c",
      "title": "processes to ensure security, integrity, confidentiality, availability",
      "content": "and resilience of processing systems and services ;",
      "page_start": 25,
      "page_end": 25,
      "content_length": 51
    },
    {
      "level": 3,
      "number": "d",
      "title": "processes to restore availability of and access to personal data in a",
      "content": "timely manner, in the event of a physical or technical incident ;",
      "page_start": 25,
      "page_end": 25,
      "content_length": 65
    },
    {
      "level": 3,
      "number": "e",
      "title": "periodic assessments of risks to processing systems and services,",
      "content": "including where the processing involves the transmission of data over an\nelectronic communications network ;\n(f ) regular testing, assessing, and evaluation of the effectiveness of the\nmeasures implemented against current and evolving risks identified ; and",
      "page_start": 25,
      "page_end": 25,
      "content_length": 257
    },
    {
      "level": 3,
      "number": "g",
      "title": "regular updating of the measures and introduction of new measures",
      "content": "to address shortcomings in effectiveness, and accommodate evolving risks.\n40.—",
      "page_start": 25,
      "page_end": 25,
      "content_length": 78
    },
    {
      "level": 3,
      "number": "1",
      "title": "Where a personal data breach has occurred with respect to Personal",
      "content": "personal data being stored or processed by a data processor, the data processor data\nshall, on becoming aware of the breach — breaches",
      "page_start": 25,
      "page_end": 25,
      "content_length": 134
    },
    {
      "level": 3,
      "number": "a",
      "title": "notify the data controller or data processor that engaged it,",
      "content": "describing the nature of the personal data breach including, where possible,\nthe categories and approximate numbers of data subjects and personal\ndata records concerned ; and",
      "page_start": 25,
      "page_end": 25,
      "content_length": 174
    },
    {
      "level": 3,
      "number": "b",
      "title": "respond to all information requests from the data controller or data",
      "content": "processor that engaged it, as they may require to comply with their obligations\nunder this section.",
      "page_start": 25,
      "page_end": 25,
      "content_length": 99
    },
    {
      "level": 3,
      "number": "2",
      "title": "A data controller shall, within 72 hours of becoming aware of a",
      "content": "breach which is likely to result in a risk to the rights and freedoms of individuals,\nnotify the Commission of the breach and, where feasible, describe the nature\nof the personal data breach including the categories and approximate numbers\nof data subjects and personal data records concerned.",
      "page_start": 26,
      "page_end": 26,
      "content_length": 293
    },
    {
      "level": 3,
      "number": "3",
      "title": "Where a personal data breach is likely to result in a high risk to the",
      "content": "rights and freedoms of a data subject the data controller shall immediately\ncommunicate the personal data breach to the data subject in plain and clear\nlanguage, including advice about measures the data subject could take to\nmitigate effectively the possible adverse effects of the data breach and if a\ndirect communication to the data subject would involve disproportionate effort\nor expense, or is otherwise not feasible, the data controller may instead make\na public communication in one or more w...",
      "page_start": 26,
      "page_end": 26,
      "content_length": 577
    },
    {
      "level": 3,
      "number": "4",
      "title": "The notifications and communications referred to in subsections",
      "content": "",
      "page_start": 26,
      "page_end": 26,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "1",
      "title": ",",
      "content": "",
      "page_start": 26,
      "page_end": 26,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "2",
      "title": "and",
      "content": "",
      "page_start": 26,
      "page_end": 26,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "3",
      "title": "shall, in addition to the requirements of those subsections —",
      "content": "",
      "page_start": 26,
      "page_end": 26,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "a",
      "title": "communicate the name and contact details of a point of contact of",
      "content": "the data controller, where more information can be obtained ;",
      "page_start": 26,
      "page_end": 26,
      "content_length": 61
    },
    {
      "level": 3,
      "number": "b",
      "title": "describe the likely consequences of the personal data breach ; and",
      "content": "",
      "page_start": 26,
      "page_end": 26,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "c",
      "title": "describe the measures taken or proposed to be taken to address the",
      "content": "personal data breach, including, where appropriate, measures to mitigate\nits possible adverse effects.",
      "page_start": 26,
      "page_end": 26,
      "content_length": 102
    },
    {
      "level": 3,
      "number": "5",
      "title": "The Commission may, at any time, make a public communication",
      "content": "about a personal data breach notified to it under subsection",
      "page_start": 26,
      "page_end": 26,
      "content_length": 60
    },
    {
      "level": 3,
      "number": "2",
      "title": ", where it",
      "content": "considers the steps of the data controller to inform data subjects inadequate.",
      "page_start": 26,
      "page_end": 26,
      "content_length": 78
    },
    {
      "level": 3,
      "number": "6",
      "title": "The Commission shall issue and publish regulations on the steps to",
      "content": "be taken by a data controller to adequately inform data subjects of a personal\ndata breach for purposes of subsection",
      "page_start": 26,
      "page_end": 26,
      "content_length": 117
    },
    {
      "level": 3,
      "number": "3",
      "title": ".",
      "content": "",
      "page_start": 26,
      "page_end": 26,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "7",
      "title": "In evaluating whether a personal data breach is likely to result in a",
      "content": "risk to the rights and freedoms of a data subject under subsection",
      "page_start": 26,
      "page_end": 26,
      "content_length": 66
    },
    {
      "level": 3,
      "number": "3",
      "title": ", a data",
      "content": "controller and the Commission may take into account —",
      "page_start": 26,
      "page_end": 26,
      "content_length": 53
    },
    {
      "level": 3,
      "number": "a",
      "title": "the likely effectiveness of any technical and administrative measures",
      "content": "implemented to mitigate the likely harm resulting from the personal data breach,\nincluding any encryption or de-identification of the data ;",
      "page_start": 26,
      "page_end": 26,
      "content_length": 140
    },
    {
      "level": 3,
      "number": "b",
      "title": "any subsequent measures taken by the data controller to mitigate",
      "content": "such risk ; and\n(c) the nature, scope and sensitivity of the personal data involved.",
      "page_start": 26,
      "page_end": 26,
      "content_length": 84
    },
    {
      "level": 1,
      "number": "41",
      "title": "—(1) A data controller or data processor shall not transfer or permit Basis for",
      "content": "personal data to be transferred from Nigeria to another country, unless — cross-border\ntransfer of\n(a) the recipient of the personal data is subject to a law, binding corporate\npersonal\nrules, contractual clauses, code of conduct, or certification mechanism that data\naffords an adequate level of protection with respect to the personal data in\naccordance with this Act ; or\n(b) one of the conditions set out in section 43 of this Act applies.\n(2) A data controller or data processor shall record the...",
      "page_start": 27,
      "page_end": 27,
      "content_length": 1082
    },
    {
      "level": 1,
      "number": "42",
      "title": "—(1) A level of protection is adequate for the purposes of this section Adequacy of",
      "content": "if it upholds principles that are substantially similar to the conditions for protection\nprocessing of the personal data provided for in this Act.\n(2) The adequacy of protection referred to in subsection (1) shall be\nassessed taking into account the —\n(a) availability of enforceable data subject rights, the ability of a data\nsubject to enforce such rights through administrative or judicial redress,\nand the rule of law ;\n(b) existence of any appropriate instrument between the Commission\nand a com...",
      "page_start": 27,
      "page_end": 27,
      "content_length": 838
    },
    {
      "level": 3,
      "number": "8",
      "title": "A data controller and data processor shall keep a record of all personal",
      "content": "data breaches, comprising the facts relating to the personal data breach, its\neffects and the remedial action taken in a manner that enables the Commission\nto verify compliance with this section.",
      "page_start": 27,
      "page_end": 27,
      "content_length": 195
    },
    {
      "level": 3,
      "number": "9",
      "title": "Where it is not possible to provide information under this section at",
      "content": "the same time, the information may be provided in phases without undue delay.\nPART VIII — CROSS-BORDER TRANSFERS OF PERSONAL DATA\n41.—",
      "page_start": 27,
      "page_end": 27,
      "content_length": 134
    },
    {
      "level": 3,
      "number": "1",
      "title": "A data controller or data processor shall not transfer or permit Basis for",
      "content": "personal data to be transferred from Nigeria to another country, unless — cross-border\ntransfer of",
      "page_start": 27,
      "page_end": 27,
      "content_length": 98
    },
    {
      "level": 3,
      "number": "a",
      "title": "the recipient of the personal data is subject to a law, binding corporate",
      "content": "personal\nrules, contractual clauses, code of conduct, or certification mechanism that data\naffords an adequate level of protection with respect to the personal data in\naccordance with this Act ; or",
      "page_start": 27,
      "page_end": 27,
      "content_length": 197
    },
    {
      "level": 3,
      "number": "b",
      "title": "one of the conditions set out in section 43 of this Act applies.",
      "content": "",
      "page_start": 27,
      "page_end": 27,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "2",
      "title": "A data controller or data processor shall record the basis for transfer",
      "content": "of personal data to another country under subsection",
      "page_start": 27,
      "page_end": 27,
      "content_length": 52
    },
    {
      "level": 3,
      "number": "1",
      "title": "and the adequacy of",
      "content": "protection under section 42 of this Act.",
      "page_start": 27,
      "page_end": 27,
      "content_length": 40
    },
    {
      "level": 3,
      "number": "3",
      "title": "The Commission may make regulations requiring data controllers",
      "content": "and data processors to notify it of the measures in place under subsection",
      "page_start": 27,
      "page_end": 27,
      "content_length": 74
    },
    {
      "level": 3,
      "number": "1",
      "title": "and to explain their adequacy in terms of section 42 of this Act.",
      "content": "",
      "page_start": 27,
      "page_end": 27,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "4",
      "title": "The Commission may, by regulations, designate categories of personal",
      "content": "data that are subject to additional specified restrictions on transfer to another\ncountry based on the nature of such personal data and risks to data subjects.\n42.—",
      "page_start": 27,
      "page_end": 27,
      "content_length": 164
    },
    {
      "level": 3,
      "number": "1",
      "title": "A level of protection is adequate for the purposes of this section Adequacy of",
      "content": "if it upholds principles that are substantially similar to the conditions for protection\nprocessing of the personal data provided for in this Act.",
      "page_start": 27,
      "page_end": 27,
      "content_length": 146
    },
    {
      "level": 3,
      "number": "2",
      "title": "The adequacy of protection referred to in subsection",
      "content": "",
      "page_start": 27,
      "page_end": 27,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "1",
      "title": "shall be",
      "content": "assessed taking into account the —",
      "page_start": 27,
      "page_end": 27,
      "content_length": 34
    },
    {
      "level": 3,
      "number": "a",
      "title": "availability of enforceable data subject rights, the ability of a data",
      "content": "subject to enforce such rights through administrative or judicial redress,\nand the rule of law ;",
      "page_start": 27,
      "page_end": 27,
      "content_length": 96
    },
    {
      "level": 3,
      "number": "b",
      "title": "existence of any appropriate instrument between the Commission",
      "content": "and a competent authority in the recipient jurisdiction that ensures adequate\ndata protection ;",
      "page_start": 27,
      "page_end": 27,
      "content_length": 95
    },
    {
      "level": 3,
      "number": "c",
      "title": "access of a public authority to personal data ;",
      "content": "",
      "page_start": 27,
      "page_end": 27,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "d",
      "title": "existence of an effective data protection law ;",
      "content": "",
      "page_start": 27,
      "page_end": 27,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "e",
      "title": "existence and functioning of an independent, competent data",
      "content": "protection, or similar supervisory authority with adequate enforcement\npowers ; and",
      "page_start": 27,
      "page_end": 27,
      "content_length": 83
    },
    {
      "level": 1,
      "number": "43",
      "title": "—(1) In the absence of adequacy of protection under section ż42 of",
      "content": "for transfer this Act, a data controller or data processor shall only transfer personal data\nof personal\nfrom Nigeria to another country if the—\ndata outside\nNigeria (a) data subject has provided and not withdrawn consent to such transfer\nafter having been informed of the possible risks of such transfers for the data\nsubject due to the absence of adequate protections ;\n(b) transfer is necessary for the performance of a contract to which a\ndata subject is a party or in order to take steps at the ...",
      "page_start": 28,
      "page_end": 28,
      "content_length": 1159
    },
    {
      "level": 3,
      "number": "3",
      "title": "The Commission shall issue guidelines as to the assessment of",
      "content": "adequacy and the factors set out under subsection",
      "page_start": 28,
      "page_end": 28,
      "content_length": 49
    },
    {
      "level": 3,
      "number": "2",
      "title": ".",
      "content": "",
      "page_start": 28,
      "page_end": 28,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "4",
      "title": "The Commission may determine whether a country, region or specified",
      "content": "sector within a country, or standard contractual clauses, affords an adequate\nlevel of protection under subsection",
      "page_start": 28,
      "page_end": 28,
      "content_length": 114
    },
    {
      "level": 3,
      "number": "1",
      "title": ".",
      "content": "",
      "page_start": 28,
      "page_end": 28,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "5",
      "title": "The Commission may approve binding corporate rules, codes of conduct,",
      "content": "certification mechanisms or similar instruments for data transfer proposed to it,\nwhere the Commission is satisfied that such instruments meet appropriate\nstandards of data protection in accordance with the objectives of this Act.",
      "page_start": 28,
      "page_end": 28,
      "content_length": 230
    },
    {
      "level": 3,
      "number": "6",
      "title": "The absence of a determination by the Commission under subsection",
      "content": "",
      "page_start": 28,
      "page_end": 28,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "4",
      "title": "or",
      "content": "",
      "page_start": 28,
      "page_end": 28,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "5",
      "title": "with respect to a country, territory, sector, binding corporate rules,",
      "content": "contractual clause, code of conduct, or certification mechanism shall not imply\nthe adequacy of the protections afforded by it.",
      "page_start": 28,
      "page_end": 28,
      "content_length": 127
    },
    {
      "level": 3,
      "number": "7",
      "title": "The Commission may make a determination under subsection",
      "content": "",
      "page_start": 28,
      "page_end": 28,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "4",
      "title": "based on adequacy decision made by a competent authority of other",
      "content": "jurisdictions, where such decision have taken into account factors similar to\nthose listed in this section.\nOther bases 43.—",
      "page_start": 28,
      "page_end": 28,
      "content_length": 124
    },
    {
      "level": 3,
      "number": "1",
      "title": "In the absence of adequacy of protection under section ż42 of",
      "content": "for transfer this Act, a data controller or data processor shall only transfer personal data\nof personal\nfrom Nigeria to another country if the—\ndata outside\nNigeria",
      "page_start": 28,
      "page_end": 28,
      "content_length": 165
    },
    {
      "level": 3,
      "number": "a",
      "title": "data subject has provided and not withdrawn consent to such transfer",
      "content": "after having been informed of the possible risks of such transfers for the data\nsubject due to the absence of adequate protections ;",
      "page_start": 28,
      "page_end": 28,
      "content_length": 132
    },
    {
      "level": 3,
      "number": "b",
      "title": "transfer is necessary for the performance of a contract to which a",
      "content": "data subject is a party or in order to take steps at the request of a data subject,\nprior to entering into a contract ;",
      "page_start": 28,
      "page_end": 28,
      "content_length": 119
    },
    {
      "level": 3,
      "number": "c",
      "title": "transfer is for the sole benefit of a data subject and —",
      "content": "",
      "page_start": 28,
      "page_end": 28,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "i",
      "title": "it is not reasonably practicable to obtain the consent of the data subject",
      "content": "to that transfer, and\n(ii) if it were reasonably practicable to obtain such consent, the data\nsubject would likely give it ;",
      "page_start": 28,
      "page_end": 28,
      "content_length": 124
    },
    {
      "level": 3,
      "number": "d",
      "title": "transfer is necessary for important reasons of public interest ;",
      "content": "",
      "page_start": 28,
      "page_end": 28,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "e",
      "title": "transfer is necessary for the establishment, exercise, or defense of",
      "content": "legal claims ; or\n(f ) transfer is necessary to protect the vital interests of a data subject\nor of other persons, where a data subject is physically or legally incapable of\ngiving consent.",
      "page_start": 28,
      "page_end": 28,
      "content_length": 189
    },
    {
      "level": 1,
      "number": "44",
      "title": "—(1) Data controllers and data processors of major importance",
      "content": "Registration\nshall register with the Commission within six months after the commencement\nof data\nof the Act or on becoming a data controller or data processor of major\ncontrollers\nimportance. and data\nprocessors\n(2) Registration under subsection (1) shall be made by notifying the\nof major\nCommission of —\nimportance\n(a) the name and address of the data controller or data processor, and\nname and address of the data protection officer of the data controller or\ndata processor ;\n(b) a description of ...",
      "page_start": 29,
      "page_end": 29,
      "content_length": 2026
    },
    {
      "level": 3,
      "number": "2",
      "title": "Without prejudice to any provision of this Act, no specific international,",
      "content": "multi-national cross border data transfer codes, rules or certification\nmechanisms shall be adopted as Federal Republic of Nigeria standard for the\nprotection of data subject or data sovereignty without approval of the National\nAssembly.\nPART IX — REGISTRATION AND FEES\n44.—",
      "page_start": 29,
      "page_end": 29,
      "content_length": 274
    },
    {
      "level": 3,
      "number": "1",
      "title": "Data controllers and data processors of major importance",
      "content": "Registration\nshall register with the Commission within six months after the commencement\nof data\nof the Act or on becoming a data controller or data processor of major\ncontrollers\nimportance. and data\nprocessors",
      "page_start": 29,
      "page_end": 29,
      "content_length": 211
    },
    {
      "level": 3,
      "number": "2",
      "title": "Registration under subsection",
      "content": "",
      "page_start": 29,
      "page_end": 29,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "1",
      "title": "shall be made by notifying the",
      "content": "of major\nCommission of —\nimportance",
      "page_start": 29,
      "page_end": 29,
      "content_length": 35
    },
    {
      "level": 3,
      "number": "a",
      "title": "the name and address of the data controller or data processor, and",
      "content": "name and address of the data protection officer of the data controller or\ndata processor ;",
      "page_start": 29,
      "page_end": 29,
      "content_length": 90
    },
    {
      "level": 3,
      "number": "b",
      "title": "a description of personal data and the categories and number of",
      "content": "data subjects to which the personal data relate ;",
      "page_start": 29,
      "page_end": 29,
      "content_length": 49
    },
    {
      "level": 3,
      "number": "c",
      "title": "the purposes for which personal data is processed ;",
      "content": "",
      "page_start": 29,
      "page_end": 29,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "d",
      "title": "the categories of recipients to whom the data controller or data",
      "content": "processor intends or is likely to disclose personal data ;",
      "page_start": 29,
      "page_end": 29,
      "content_length": 58
    },
    {
      "level": 3,
      "number": "e",
      "title": "the name and address, or name and address of any representative of",
      "content": "any data processor operating directly or indirectly on its behalf ;\n(f ) the country to which the data controller or data processor intends,\ndirectly or indirectly to transfer the personal data ;",
      "page_start": 29,
      "page_end": 29,
      "content_length": 195
    },
    {
      "level": 3,
      "number": "g",
      "title": "a general description of the risks, safeguards, security measures",
      "content": "and mechanisms to ensure the protection of the personal data ; and",
      "page_start": 29,
      "page_end": 29,
      "content_length": 66
    },
    {
      "level": 3,
      "number": "h",
      "title": "any other information required by the Commission.",
      "content": "",
      "page_start": 29,
      "page_end": 29,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "3",
      "title": "A data controller or data processor of major importance shall notify",
      "content": "the Commission of any significant change to the information submitted under\nsubsection",
      "page_start": 29,
      "page_end": 29,
      "content_length": 86
    },
    {
      "level": 3,
      "number": "2",
      "title": "within 60 days after such change.",
      "content": "",
      "page_start": 29,
      "page_end": 29,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "4",
      "title": "The Commission shall maintain and publish on its website a register",
      "content": "of duly registered data controllers and data processors of major importance.",
      "page_start": 29,
      "page_end": 29,
      "content_length": 76
    },
    {
      "level": 3,
      "number": "5",
      "title": "A data controller or data processor shall be removed from the register",
      "content": "of the Commission, where it notifies the Commission that it has ceased to\noperate as a data controller or data processor of major importance.",
      "page_start": 29,
      "page_end": 29,
      "content_length": 141
    },
    {
      "level": 3,
      "number": "6",
      "title": "The Commission may exempt a class of data controllers or data",
      "content": "processors of major importance from the registration requirements of this\nsection, where it considers such requirement to be unnecessary or\ndisproportionate.",
      "page_start": 29,
      "page_end": 29,
      "content_length": 157
    },
    {
      "level": 1,
      "number": "45",
      "title": "The Commission may prescribe fees or levies to be paid by data",
      "content": "levies\ncontrollers and data processors of major importance.\nPART X — ENFORCEMENT\nComplaints",
      "page_start": 30,
      "page_end": 30,
      "content_length": 91
    },
    {
      "level": 1,
      "number": "46",
      "title": "—(1) A data subject, who is aggrieved by the decision, action, or",
      "content": "and inaction of a data controller or data processor in violation of this Act, or subsidiary\ninvestigations legislation made under this Act may lodge a complaint with the Commission.\n(2) The Commission may investigate any complaint referred to it, where\nit appears to the Commission that the complaint is not frivolous or vexatious.\n(3) The Commission may initiate an investigation of its own accord where\nit has reason to believe a data controller or data processor has violated or is\nlikely to viola...",
      "page_start": 30,
      "page_end": 30,
      "content_length": 2073
    },
    {
      "level": 3,
      "number": "1",
      "title": "A data subject, who is aggrieved by the decision, action, or",
      "content": "and inaction of a data controller or data processor in violation of this Act, or subsidiary\ninvestigations legislation made under this Act may lodge a complaint with the Commission.",
      "page_start": 30,
      "page_end": 30,
      "content_length": 181
    },
    {
      "level": 3,
      "number": "2",
      "title": "The Commission may investigate any complaint referred to it, where",
      "content": "it appears to the Commission that the complaint is not frivolous or vexatious.",
      "page_start": 30,
      "page_end": 30,
      "content_length": 78
    },
    {
      "level": 3,
      "number": "3",
      "title": "The Commission may initiate an investigation of its own accord where",
      "content": "it has reason to believe a data controller or data processor has violated or is\nlikely to violate this Act or any subsidiary legislation made under this Act.",
      "page_start": 30,
      "page_end": 30,
      "content_length": 157
    },
    {
      "level": 3,
      "number": "4",
      "title": "The Commission may, for the purpose of an investigation, order a",
      "content": "person to —",
      "page_start": 30,
      "page_end": 30,
      "content_length": 11
    },
    {
      "level": 3,
      "number": "a",
      "title": "attend at a specific time and place for the purpose of being examined",
      "content": "orally in relation to a complaint ;",
      "page_start": 30,
      "page_end": 30,
      "content_length": 35
    },
    {
      "level": 3,
      "number": "b",
      "title": "produce such document, record, or article, as may be required with",
      "content": "respect to any matter relevant to the investigation, which the person is not\nprevented by any other written law from disclosing ; or",
      "page_start": 30,
      "page_end": 30,
      "content_length": 132
    },
    {
      "level": 3,
      "number": "c",
      "title": "furnish a statement in writing made under oath or an affirmation",
      "content": "setting out all information, which may be required under the order.",
      "page_start": 30,
      "page_end": 30,
      "content_length": 67
    },
    {
      "level": 3,
      "number": "5",
      "title": "Where any material to which an investigation relates, consists of",
      "content": "information stored in any document, record, minutes, mechanical or electronic\ndevice, the Commission may require the person named to produce such material\nor give access to the Commission to conduct an inspection on the material.",
      "page_start": 30,
      "page_end": 30,
      "content_length": 229
    },
    {
      "level": 3,
      "number": "6",
      "title": "For the purposes of subsection",
      "content": "",
      "page_start": 30,
      "page_end": 30,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "5",
      "title": ", the person shall ensure that the",
      "content": "information relating to the material under investigation is visible and legible, in\na structured, commonly used and machine-readable format.",
      "page_start": 30,
      "page_end": 30,
      "content_length": 140
    },
    {
      "level": 3,
      "number": "7",
      "title": "The Commission may, where necessary, make representations to —",
      "content": "",
      "page_start": 30,
      "page_end": 30,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "a",
      "title": "the data controller or data processor on behalf of a complainant ; or",
      "content": "",
      "page_start": 30,
      "page_end": 30,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "b",
      "title": "a complainant on behalf of the data controller or data processor.",
      "content": "",
      "page_start": 30,
      "page_end": 30,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "8",
      "title": "The Commission shall —",
      "content": "",
      "page_start": 30,
      "page_end": 30,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "a",
      "title": "establish a unit to receive and follow up on complaints from data",
      "content": "subjects and conduct investigations ; and",
      "page_start": 30,
      "page_end": 30,
      "content_length": 41
    },
    {
      "level": 3,
      "number": "b",
      "title": "adopt rules and procedures on handling complaints and conducting",
      "content": "investigations referred to it under this Act.",
      "page_start": 30,
      "page_end": 30,
      "content_length": 45
    },
    {
      "level": 1,
      "number": "47",
      "title": "—(1) Where the Commission is satisfied that a data controller or Compliance",
      "content": "data processor has violated or is likely to violate any requirement under this orders\nAct or subsidiary legislation made under this Act, the Commission may make\nan appropriate compliance order against that data controller or data processor.\n(2) The order made by the Commission under subsection (1) may\ninclude a —\n(a) warning that certain act or omission is likely to be a violation of one\nor more provisions under this Act or any subsidiary legislation or orders\nissued under it ;\n(b) requirement t...",
      "page_start": 31,
      "page_end": 31,
      "content_length": 1396
    },
    {
      "level": 1,
      "number": "48",
      "title": "—(1) Notwithstanding any criminal sanctions under this Act, if the Enforcement",
      "content": "Commission, after completing an investigation under section 46 of this Act, is orders\nsatisfied that a data controller or data processor has violated any provision of\nthis Act or subsidiary legislation made under this Act, it —\n(a) may make any appropriate enforcement order or impose a sanction\non the data controller or data processor ; and\n(b) shall inform the data controller or data processor, and if applicable,\nany data subject who lodged a complaint leading to the investigation, in\nwriting o...",
      "page_start": 31,
      "page_end": 31,
      "content_length": 838
    },
    {
      "level": 3,
      "number": "1",
      "title": "Where the Commission is satisfied that a data controller or Compliance",
      "content": "data processor has violated or is likely to violate any requirement under this orders\nAct or subsidiary legislation made under this Act, the Commission may make\nan appropriate compliance order against that data controller or data processor.",
      "page_start": 31,
      "page_end": 31,
      "content_length": 240
    },
    {
      "level": 3,
      "number": "2",
      "title": "The order made by the Commission under subsection",
      "content": "",
      "page_start": 31,
      "page_end": 31,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "1",
      "title": "may",
      "content": "include a —",
      "page_start": 31,
      "page_end": 31,
      "content_length": 11
    },
    {
      "level": 3,
      "number": "a",
      "title": "warning that certain act or omission is likely to be a violation of one",
      "content": "or more provisions under this Act or any subsidiary legislation or orders\nissued under it ;",
      "page_start": 31,
      "page_end": 31,
      "content_length": 91
    },
    {
      "level": 3,
      "number": "b",
      "title": "requirement that the data controller or data processor complies with",
      "content": "such provisions, including complying with the requests of a data subject to\nexercise one or more rights under this Act ; or",
      "page_start": 31,
      "page_end": 31,
      "content_length": 123
    },
    {
      "level": 3,
      "number": "c",
      "title": "cease and desist order requiring the data controller or data processor",
      "content": "to stop or refrain from doing an act, which is in violation of this Act, including\nstopping or refraining from processing personal data that is the subject of\nthe order.",
      "page_start": 31,
      "page_end": 31,
      "content_length": 169
    },
    {
      "level": 3,
      "number": "3",
      "title": "An order made under this section shall be in writing and shall",
      "content": "specify —",
      "page_start": 31,
      "page_end": 31,
      "content_length": 9
    },
    {
      "level": 3,
      "number": "a",
      "title": "the provisions of this Act that the Commission is satisfied the data",
      "content": "controller or data processor has violated ;",
      "page_start": 31,
      "page_end": 31,
      "content_length": 43
    },
    {
      "level": 3,
      "number": "b",
      "title": "specific measures to be taken by the data controller or data processor to",
      "content": "avoid, remedy, or eliminate the situation which has resulted in the violation ;",
      "page_start": 31,
      "page_end": 31,
      "content_length": 79
    },
    {
      "level": 3,
      "number": "c",
      "title": "a period within which to implement such measures ; and",
      "content": "",
      "page_start": 31,
      "page_end": 31,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "d",
      "title": "a right to judicial review under section 50 of this Act.",
      "content": "48.—",
      "page_start": 31,
      "page_end": 31,
      "content_length": 4
    },
    {
      "level": 3,
      "number": "1",
      "title": "Notwithstanding any criminal sanctions under this Act, if the Enforcement",
      "content": "Commission, after completing an investigation under section 46 of this Act, is orders\nsatisfied that a data controller or data processor has violated any provision of\nthis Act or subsidiary legislation made under this Act, it —",
      "page_start": 31,
      "page_end": 31,
      "content_length": 227
    },
    {
      "level": 3,
      "number": "a",
      "title": "may make any appropriate enforcement order or impose a sanction",
      "content": "on the data controller or data processor ; and",
      "page_start": 31,
      "page_end": 31,
      "content_length": 46
    },
    {
      "level": 3,
      "number": "b",
      "title": "shall inform the data controller or data processor, and if applicable,",
      "content": "any data subject who lodged a complaint leading to the investigation, in\nwriting of its decision.",
      "page_start": 31,
      "page_end": 31,
      "content_length": 97
    },
    {
      "level": 3,
      "number": "2",
      "title": "An enforcement order made or sanction imposed under subsection",
      "content": "",
      "page_start": 31,
      "page_end": 31,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "1",
      "title": "shall include —",
      "content": "",
      "page_start": 31,
      "page_end": 31,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "a",
      "title": "requiring the data controller or data processor to remedy the violation ;",
      "content": "",
      "page_start": 31,
      "page_end": 31,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "b",
      "title": "ordering the data controller or data processor to pay compensation",
      "content": "to a data subject, who has suffered injury, loss, or harm as a result of a\nviolation ;",
      "page_start": 31,
      "page_end": 31,
      "content_length": 86
    },
    {
      "level": 1,
      "number": "49",
      "title": "—(1) A data controller or data processor, who fails to comply with",
      "content": "and orders made under section 47 of this Act commits an offence and is liable on\npenalties\nconviction to —\n(a) a fine of up to the —\n(i) higher maximum amount, in the case of a data controller or data\nprocessor of major importance, or\n(ii) standard maximum amount, in the case of a data controller or\ndata processor not of major importance ; or\n(b) imprisonment for a term not more than one year or both.\nJudicial",
      "page_start": 32,
      "page_end": 32,
      "content_length": 413
    },
    {
      "level": 1,
      "number": "50",
      "title": "A person who is not satisfied with an order of the Commission, may",
      "content": "review apply to the court for judicial review within 30 days after the order was made.",
      "page_start": 32,
      "page_end": 32,
      "content_length": 86
    },
    {
      "level": 3,
      "number": "c",
      "title": "ordering the data controller or data processor to account for the",
      "content": "profits realised from the violation ; or",
      "page_start": 32,
      "page_end": 32,
      "content_length": 40
    },
    {
      "level": 3,
      "number": "d",
      "title": "ordering the data controller or data processor to pay a penalty or",
      "content": "remedial fee.",
      "page_start": 32,
      "page_end": 32,
      "content_length": 13
    },
    {
      "level": 3,
      "number": "3",
      "title": "A penalty or remedial fee under subsection",
      "content": "",
      "page_start": 32,
      "page_end": 32,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "2",
      "title": "(d) may be an amount",
      "content": "up to the —",
      "page_start": 32,
      "page_end": 32,
      "content_length": 11
    },
    {
      "level": 3,
      "number": "a",
      "title": "higher maximum amount, in the case of a data controller or data",
      "content": "processor of major importance ; or",
      "page_start": 32,
      "page_end": 32,
      "content_length": 34
    },
    {
      "level": 3,
      "number": "b",
      "title": "standard maximum amount, in the case of a data controller or data",
      "content": "processor not of major importance.",
      "page_start": 32,
      "page_end": 32,
      "content_length": 34
    },
    {
      "level": 3,
      "number": "4",
      "title": "The “higher maximum amount” shall be the greater of —",
      "content": "",
      "page_start": 32,
      "page_end": 32,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "a",
      "title": "N10,000,000, and",
      "content": "",
      "page_start": 32,
      "page_end": 32,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "b",
      "title": "2% of its annual gross revenue in the preceding financial year.",
      "content": "",
      "page_start": 32,
      "page_end": 32,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "5",
      "title": "The “standard maximum amount” shall be the greater of —",
      "content": "",
      "page_start": 32,
      "page_end": 32,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "a",
      "title": "N2,000,000, and",
      "content": "",
      "page_start": 32,
      "page_end": 32,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "b",
      "title": "2% of its annual gross revenue in the preceding financial year.",
      "content": "",
      "page_start": 32,
      "page_end": 32,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "6",
      "title": "The Commission shall, in determining the sanctions, take into",
      "content": "consideration the —",
      "page_start": 32,
      "page_end": 32,
      "content_length": 19
    },
    {
      "level": 3,
      "number": "a",
      "title": "nature, gravity, and duration of the infringement ;",
      "content": "",
      "page_start": 32,
      "page_end": 32,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "b",
      "title": "purpose of the processing ;",
      "content": "",
      "page_start": 32,
      "page_end": 32,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "c",
      "title": "number of data subjects involved ;",
      "content": "",
      "page_start": 32,
      "page_end": 32,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "d",
      "title": "level of damage and damage mitigation measures implemented ;",
      "content": "",
      "page_start": 32,
      "page_end": 32,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "e",
      "title": "intent or negligence ;",
      "content": "(f ) degree of cooperation with the Commission ; and",
      "page_start": 32,
      "page_end": 32,
      "content_length": 52
    },
    {
      "level": 3,
      "number": "g",
      "title": "types of personal data involved.",
      "content": "Offences 49.—",
      "page_start": 32,
      "page_end": 32,
      "content_length": 13
    },
    {
      "level": 3,
      "number": "1",
      "title": "A data controller or data processor, who fails to comply with",
      "content": "and orders made under section 47 of this Act commits an offence and is liable on\npenalties\nconviction to —",
      "page_start": 32,
      "page_end": 32,
      "content_length": 106
    },
    {
      "level": 3,
      "number": "a",
      "title": "a fine of up to the —",
      "content": "",
      "page_start": 32,
      "page_end": 32,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "i",
      "title": "higher maximum amount, in the case of a data controller or data",
      "content": "processor of major importance, or\n(ii) standard maximum amount, in the case of a data controller or\ndata processor not of major importance ; or",
      "page_start": 32,
      "page_end": 32,
      "content_length": 143
    },
    {
      "level": 3,
      "number": "b",
      "title": "imprisonment for a term not more than one year or both.",
      "content": "Judicial 50. A person who is not satisfied with an order of the Commission, may\nreview apply to the court for judicial review within 30 days after the order was made.",
      "page_start": 32,
      "page_end": 32,
      "content_length": 166
    },
    {
      "level": 1,
      "number": "51",
      "title": "A data subject, who suffers injury, loss, or harm as a result of a Civil",
      "content": "violation of this Act by a data controller or data processor, may recover remedies\ndamages from such data controller or data processor in civil proceedings.",
      "page_start": 33,
      "page_end": 33,
      "content_length": 156
    },
    {
      "level": 1,
      "number": "52",
      "title": "Notwithstanding anything to the contrary, the Court may make an Forfeiture",
      "content": "order of forfeiture against a convicted data controller, data processor, or\nAct No. 16,\nindividual in accordance with the Proceeds of Crime (Recovery and\n2022\nManagement) Act.",
      "page_start": 33,
      "page_end": 33,
      "content_length": 175
    },
    {
      "level": 1,
      "number": "53",
      "title": "—(1) Where an offence has been committed by a body corporate or Joint and",
      "content": "firm, the body corporate or firm, as well as principal officers of the body vicarious\nliability\ncorporate or firm shall be deemed culpable, unless the principal officers prove\nthat —\n(a) the offence was committed without their consent or connivance ; and\n(b) they exercised diligence to prevent the commission of the offence.\n(2) A data controller and data processor shall be vicariously liable for\nthe acts or omissions of its agent or employees, in so far as the acts or omissions\nrelate to its bus...",
      "page_start": 33,
      "page_end": 33,
      "content_length": 534
    },
    {
      "level": 1,
      "number": "54",
      "title": "—(1) A suit shall not be instituted against the Commission, a member Limitation of",
      "content": "of the Council, or staff of the Commission for an act done under or in execution suits against\nthe\nof this Act, or any public duty of the Commission, unless —\nCommission\n(a) it is commenced within three months after the act, neglect, or default\ncomplained of ; or\n(b) in the case of continued damage or injury, within three months after\nthe ceasing of such act, neglect or default complained of.\n(2) A suit shall not be commenced against the Commission, a member\nof the Council, or staff of the Commi...",
      "page_start": 33,
      "page_end": 33,
      "content_length": 1129
    },
    {
      "level": 3,
      "number": "1",
      "title": "Where an offence has been committed by a body corporate or Joint and",
      "content": "firm, the body corporate or firm, as well as principal officers of the body vicarious\nliability\ncorporate or firm shall be deemed culpable, unless the principal officers prove\nthat —",
      "page_start": 33,
      "page_end": 33,
      "content_length": 182
    },
    {
      "level": 3,
      "number": "a",
      "title": "the offence was committed without their consent or connivance ; and",
      "content": "",
      "page_start": 33,
      "page_end": 33,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "b",
      "title": "they exercised diligence to prevent the commission of the offence.",
      "content": "",
      "page_start": 33,
      "page_end": 33,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "2",
      "title": "A data controller and data processor shall be vicariously liable for",
      "content": "the acts or omissions of its agent or employees, in so far as the acts or omissions\nrelate to its business.\nPART XI — LEGAL PROCEEDINGS\n54.—",
      "page_start": 33,
      "page_end": 33,
      "content_length": 140
    },
    {
      "level": 3,
      "number": "1",
      "title": "A suit shall not be instituted against the Commission, a member Limitation of",
      "content": "of the Council, or staff of the Commission for an act done under or in execution suits against\nthe\nof this Act, or any public duty of the Commission, unless —\nCommission",
      "page_start": 33,
      "page_end": 33,
      "content_length": 169
    },
    {
      "level": 3,
      "number": "a",
      "title": "it is commenced within three months after the act, neglect, or default",
      "content": "complained of ; or",
      "page_start": 33,
      "page_end": 33,
      "content_length": 18
    },
    {
      "level": 3,
      "number": "b",
      "title": "in the case of continued damage or injury, within three months after",
      "content": "the ceasing of such act, neglect or default complained of.",
      "page_start": 33,
      "page_end": 33,
      "content_length": 58
    },
    {
      "level": 3,
      "number": "2",
      "title": "A suit shall not be commenced against the Commission, a member",
      "content": "of the Council, or staff of the Commission before the expiration of one month\nafter written notice of intention to commence the suit is served on the\nCommission, a member, or staff of the Commission by the intending plaintiff\nor plaintiff’s agent.",
      "page_start": 33,
      "page_end": 33,
      "content_length": 247
    },
    {
      "level": 3,
      "number": "3",
      "title": "The notice referred to in subsection",
      "content": "",
      "page_start": 33,
      "page_end": 33,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "2",
      "title": "shall clearly state the —",
      "content": "",
      "page_start": 33,
      "page_end": 33,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "a",
      "title": "cause of action ;",
      "content": "",
      "page_start": 33,
      "page_end": 33,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "b",
      "title": "particulars of the claim ;",
      "content": "",
      "page_start": 33,
      "page_end": 33,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "c",
      "title": "name and place of abode of the intending plaintiff ; and",
      "content": "",
      "page_start": 33,
      "page_end": 33,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "d",
      "title": "relief sought.",
      "content": "",
      "page_start": 33,
      "page_end": 33,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "4",
      "title": "Subject to the provisions of this Act, the provisions of the Public Cap. P41,",
      "content": "Officers Protection Act, shall apply in relation to any suit instituted against an LFN, 2004\nofficial or employee of the Commission.",
      "page_start": 33,
      "page_end": 33,
      "content_length": 132
    },
    {
      "level": 1,
      "number": "55",
      "title": "A notice, summons, process, or document, required or authorised to",
      "content": "documents be served on the Commission under the provisions of this Act or any other law\nor enactment, may be served by delivering it to the National Commissioner at\nthe head office of the Commission.\nRestriction",
      "page_start": 34,
      "page_end": 34,
      "content_length": 211
    },
    {
      "level": 1,
      "number": "56",
      "title": "—(1) An execution or attachment process shall not be issued against",
      "content": "on execution the property of the Commission, in respect of an action or suit against the\nagainst\nCommission.\nproperty of\nthe (2) A sum of money which may be the judgment of any court awarded\nCommission\nagainst the Commission shall be paid from the Fund of the Commission.\nIndemnity of",
      "page_start": 34,
      "page_end": 34,
      "content_length": 284
    },
    {
      "level": 1,
      "number": "57",
      "title": "The National Commissioner, a member of Council, staff of the",
      "content": "staff, Commission, or other persons engaged by the Commission shall be indemnified\nmembers, out of the assets of the Commission against —\nand\nemployees (a) losses, charges, claims, expenses, and liabilities incurred in the\nof the discharge of official duties, or\nCommission\n(b) liability incurred in defending criminal or civil proceedings, where\nthe —\n(i) judgement is given in favour of the National Commissioner, a\nmember of the Council, or staff of the Commission,\n(ii) National Commissioner, a m...",
      "page_start": 34,
      "page_end": 34,
      "content_length": 903
    },
    {
      "level": 1,
      "number": "58",
      "title": "—(1) The Commission shall apply ex-parte to a Judge in Chambers",
      "content": "arrest, for the issuance of a warrant for the purpose of obtaining evidence in relation\nsearch, and\nto an investigation.\nseizure\n(2) A Judge may issue a warrant under subsection (1) on the satisfaction\nthat —\n(a) a person has engaged, is engaging, or is likely to engage in a conduct\nthat contravenes the provisions of this Act ;\n(b) the warrant is sought to prevent the commission of an offence under\nthis Act ;\n(c) the warrant is sought to prevent interference with investigative\nprocess under this...",
      "page_start": 34,
      "page_end": 34,
      "content_length": 732
    },
    {
      "level": 3,
      "number": "1",
      "title": "An execution or attachment process shall not be issued against",
      "content": "on execution the property of the Commission, in respect of an action or suit against the\nagainst\nCommission.\nproperty of\nthe",
      "page_start": 34,
      "page_end": 34,
      "content_length": 124
    },
    {
      "level": 3,
      "number": "2",
      "title": "A sum of money which may be the judgment of any court awarded",
      "content": "Commission\nagainst the Commission shall be paid from the Fund of the Commission.\nIndemnity of 57. The National Commissioner, a member of Council, staff of the\nstaff, Commission, or other persons engaged by the Commission shall be indemnified\nmembers, out of the assets of the Commission against —\nand\nemployees",
      "page_start": 34,
      "page_end": 34,
      "content_length": 310
    },
    {
      "level": 3,
      "number": "a",
      "title": "losses, charges, claims, expenses, and liabilities incurred in the",
      "content": "of the discharge of official duties, or\nCommission",
      "page_start": 34,
      "page_end": 34,
      "content_length": 50
    },
    {
      "level": 3,
      "number": "b",
      "title": "liability incurred in defending criminal or civil proceedings, where",
      "content": "the —",
      "page_start": 34,
      "page_end": 34,
      "content_length": 5
    },
    {
      "level": 3,
      "number": "i",
      "title": "judgement is given in favour of the National Commissioner, a",
      "content": "member of the Council, or staff of the Commission,\n(ii) National Commissioner, a member of the Council, or staff of the\nCommission is otherwise acquitted,\n(iii) proceedings are otherwise disposed of without any finding or\nadmission of any material breach of duty, or\n(iv) court grants the National Commissioner, a member of the Council,\nor staff of the Commission relief from liability for negligence, default,\nbreach of duty, or breach of trust in relation to the Commission.\nPower of 58.—",
      "page_start": 34,
      "page_end": 34,
      "content_length": 490
    },
    {
      "level": 3,
      "number": "1",
      "title": "The Commission shall apply ex-parte to a Judge in Chambers",
      "content": "arrest, for the issuance of a warrant for the purpose of obtaining evidence in relation\nsearch, and\nto an investigation.\nseizure",
      "page_start": 34,
      "page_end": 34,
      "content_length": 128
    },
    {
      "level": 3,
      "number": "2",
      "title": "A Judge may issue a warrant under subsection",
      "content": "",
      "page_start": 34,
      "page_end": 34,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "1",
      "title": "on the satisfaction",
      "content": "that —",
      "page_start": 34,
      "page_end": 34,
      "content_length": 6
    },
    {
      "level": 3,
      "number": "a",
      "title": "a person has engaged, is engaging, or is likely to engage in a conduct",
      "content": "that contravenes the provisions of this Act ;",
      "page_start": 34,
      "page_end": 34,
      "content_length": 45
    },
    {
      "level": 3,
      "number": "b",
      "title": "the warrant is sought to prevent the commission of an offence under",
      "content": "this Act ;",
      "page_start": 34,
      "page_end": 34,
      "content_length": 10
    },
    {
      "level": 3,
      "number": "c",
      "title": "the warrant is sought to prevent interference with investigative",
      "content": "process under this Act ;",
      "page_start": 34,
      "page_end": 34,
      "content_length": 24
    },
    {
      "level": 3,
      "number": "d",
      "title": "the warrant is for the purpose of investigating data security breaches",
      "content": "and data privacy breaches, or obtaining electronic evidence ; or",
      "page_start": 34,
      "page_end": 34,
      "content_length": 64
    },
    {
      "level": 3,
      "number": "e",
      "title": "the person named in the warrant is preparing to commit an offence",
      "content": "under this Act.",
      "page_start": 34,
      "page_end": 34,
      "content_length": 15
    },
    {
      "level": 1,
      "number": "59",
      "title": "A legal officer of the Commission or a private legal practitioner Right to",
      "content": "engaged by the Commission may represent the Commission in civil proceedings, appear in\nin respect of matters relating to the business or operations of the Commission. court\nPART XII — MISCELLANEOUS PROVISIONS",
      "page_start": 35,
      "page_end": 35,
      "content_length": 208
    },
    {
      "level": 1,
      "number": "60",
      "title": "Subject to the provisions of this Act, the Minister may give to the Directives",
      "content": "Commission directives of a general nature or relating generally to matters of by the\npolicy with respect to the objectives and functions of the Commission, and the Minister\nCommission shall comply with the directives.",
      "page_start": 35,
      "page_end": 35,
      "content_length": 217
    },
    {
      "level": 1,
      "number": "61",
      "title": "—(1) The Commission may make regulations for carrying out its Regulations",
      "content": "objectives under this Act.\n(2) Without prejudice to subsection (1), the regulations may provide for —\n(a) the financial management of the affairs of the Commission ;\n(b) the protection of personal data and data subjects ;\n(c) the manner in which the Commission may exercise any power,\ndischarge any duty or perform any function under this Act ;\n(d) any matter that under this Act is required or permitted to be\nprescribed ;",
      "page_start": 35,
      "page_end": 35,
      "content_length": 423
    },
    {
      "level": 3,
      "number": "3",
      "title": "A warrant issued under subsection",
      "content": "",
      "page_start": 35,
      "page_end": 35,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "2",
      "title": "shall authorise the Commission",
      "content": "to —",
      "page_start": 35,
      "page_end": 35,
      "content_length": 4
    },
    {
      "level": 3,
      "number": "a",
      "title": "in the company of a law enforcement officer, enter and search any",
      "content": "premises, where —",
      "page_start": 35,
      "page_end": 35,
      "content_length": 17
    },
    {
      "level": 3,
      "number": "i",
      "title": "an offence under this Act is being committed,",
      "content": "(ii) there is evidence of the commission of an offence under this Act\nor other relevant law,\n(iii) there is an urgent need to prevent the commission of an offence\nunder this Act or other relevant law, or\n(iv) where there is reasonable suspicion that a crime under this Act is\nor about to be committed ;",
      "page_start": 35,
      "page_end": 35,
      "content_length": 302
    },
    {
      "level": 3,
      "number": "b",
      "title": "stop and search any person found on such premises ;",
      "content": "",
      "page_start": 35,
      "page_end": 35,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "c",
      "title": "enter and search any conveyance found on the premises ;",
      "content": "",
      "page_start": 35,
      "page_end": 35,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "d",
      "title": "seize, seal, remove, or detain anything which is, or contains evidence",
      "content": "of the commission of an offence under this Act ;",
      "page_start": 35,
      "page_end": 35,
      "content_length": 48
    },
    {
      "level": 3,
      "number": "e",
      "title": "use or cause to be used a computer or other devices to search any",
      "content": "data contained in or available to any computer system or computer network;\n(f ) use any technology to decode or decrypt any coded or encrypted data\ncontained in a computer into readable text or comprehensible format ; or",
      "page_start": 35,
      "page_end": 35,
      "content_length": 220
    },
    {
      "level": 3,
      "number": "g",
      "title": "require any person having charge of or conversant with the operation",
      "content": "of a computer or electronic device in connection with an offence under this\nAct to produce such computer or electronic device.\n59. A legal officer of the Commission or a private legal practitioner Right to\nengaged by the Commission may represent the Commission in civil proceedings, appear in\nin respect of matters relating to the business or operations of the Commission. court\nPART XII — MISCELLANEOUS PROVISIONS\n60. Subject to the provisions of this Act, the Minister may give to the Directives\nCo...",
      "page_start": 35,
      "page_end": 35,
      "content_length": 720
    },
    {
      "level": 3,
      "number": "1",
      "title": "The Commission may make regulations for carrying out its Regulations",
      "content": "objectives under this Act.",
      "page_start": 35,
      "page_end": 35,
      "content_length": 26
    },
    {
      "level": 3,
      "number": "2",
      "title": "Without prejudice to subsection",
      "content": "",
      "page_start": 35,
      "page_end": 35,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "1",
      "title": ", the regulations may provide for —",
      "content": "",
      "page_start": 35,
      "page_end": 35,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "a",
      "title": "the financial management of the affairs of the Commission ;",
      "content": "",
      "page_start": 35,
      "page_end": 35,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "b",
      "title": "the protection of personal data and data subjects ;",
      "content": "",
      "page_start": 35,
      "page_end": 35,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "c",
      "title": "the manner in which the Commission may exercise any power,",
      "content": "discharge any duty or perform any function under this Act ;",
      "page_start": 35,
      "page_end": 35,
      "content_length": 59
    },
    {
      "level": 3,
      "number": "d",
      "title": "any matter that under this Act is required or permitted to be",
      "content": "prescribed ;",
      "page_start": 35,
      "page_end": 35,
      "content_length": 12
    },
    {
      "level": 1,
      "number": "62",
      "title": "The Commission may, where necessary, issue directives, codes, or",
      "content": "codes, and guidelines on the —\nguidelines\n(a) conduct of the business and operations of the Commission in a\nmanner that —\n(i) fosters accountability, ensures transparency and consistency with\nthe highest ethical standards, and\n(ii) ensures compliance with international best practices, as it relates\nto the regulation of data protection and privacy ;\n(b) budgeting and expenditure of the Commission in accordance with\nthe provisions of this Act ;\n(c) governance code for the Commission ; and\n(d) any ...",
      "page_start": 36,
      "page_end": 36,
      "content_length": 570
    },
    {
      "level": 1,
      "number": "63",
      "title": "Where the provisions of any other law or enactment, in so far as",
      "content": "the Act they provide or relate directly or indirectly to the processing of personal data,\nare inconsistent with any of the provisions of this Act, the provisions of this\nAct shall prevail.\nTransitional",
      "page_start": 36,
      "page_end": 36,
      "content_length": 201
    },
    {
      "level": 1,
      "number": "64",
      "title": "—(1) A reference to the Nigeria Data Protection Bureau (in this",
      "content": "provisions section referred to as “the Bureau”) existing before the commencement of\nthis Act, or a document issued in the name of the Bureau, shall be read as a\nreference to the Commission established under this Act, and all persons engaged\nby the Commission shall have the same rights, powers and remedies as existed\nin the Bureau before the commencement of this Act.",
      "page_start": 36,
      "page_end": 36,
      "content_length": 368
    },
    {
      "level": 3,
      "number": "e",
      "title": "the forms of applications and related documents required for the",
      "content": "purposes of this Act ;\n(f ) the procedures to be followed under this Act in the submission of\ncomplaints to the Commission ;",
      "page_start": 36,
      "page_end": 36,
      "content_length": 124
    },
    {
      "level": 3,
      "number": "g",
      "title": "frequency of filing and content of compliance returns by data",
      "content": "controllers and data processors of major importance to the Commission ;",
      "page_start": 36,
      "page_end": 36,
      "content_length": 71
    },
    {
      "level": 3,
      "number": "h",
      "title": "fees, fines, and charges prescribed under this Act and such related",
      "content": "matters ; and",
      "page_start": 36,
      "page_end": 36,
      "content_length": 13
    },
    {
      "level": 3,
      "number": "i",
      "title": "any matter that the Commission considers necessary or expedient to",
      "content": "give effect to the objectives of this Act.",
      "page_start": 36,
      "page_end": 36,
      "content_length": 42
    },
    {
      "level": 3,
      "number": "3",
      "title": "The regulations made under this Act may —",
      "content": "",
      "page_start": 36,
      "page_end": 36,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "a",
      "title": "create offences in respect of any contravention of the regulations ; and",
      "content": "",
      "page_start": 36,
      "page_end": 36,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "b",
      "title": "impose penalty not more than that prescribed in this Act.",
      "content": "",
      "page_start": 36,
      "page_end": 36,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "4",
      "title": "The Commission may, prior to making any regulation under this Act,",
      "content": "publish on its website, a draft regulation and a notice inviting comments to be\nsubmitted on the proposed regulation within a stipulated time.\nDirectives, 62. The Commission may, where necessary, issue directives, codes, or\ncodes, and guidelines on the —\nguidelines",
      "page_start": 36,
      "page_end": 36,
      "content_length": 265
    },
    {
      "level": 3,
      "number": "a",
      "title": "conduct of the business and operations of the Commission in a",
      "content": "manner that —",
      "page_start": 36,
      "page_end": 36,
      "content_length": 13
    },
    {
      "level": 3,
      "number": "i",
      "title": "fosters accountability, ensures transparency and consistency with",
      "content": "the highest ethical standards, and\n(ii) ensures compliance with international best practices, as it relates\nto the regulation of data protection and privacy ;",
      "page_start": 36,
      "page_end": 36,
      "content_length": 158
    },
    {
      "level": 3,
      "number": "b",
      "title": "budgeting and expenditure of the Commission in accordance with",
      "content": "the provisions of this Act ;",
      "page_start": 36,
      "page_end": 36,
      "content_length": 28
    },
    {
      "level": 3,
      "number": "c",
      "title": "governance code for the Commission ; and",
      "content": "",
      "page_start": 36,
      "page_end": 36,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "d",
      "title": "any other matter relevant to the operations of the Commission.",
      "content": "Priority of 63. Where the provisions of any other law or enactment, in so far as\nthe Act they provide or relate directly or indirectly to the processing of personal data,\nare inconsistent with any of the provisions of this Act, the provisions of this\nAct shall prevail.\nTransitional 64.—",
      "page_start": 36,
      "page_end": 36,
      "content_length": 287
    },
    {
      "level": 3,
      "number": "1",
      "title": "A reference to the Nigeria Data Protection Bureau (in this",
      "content": "provisions section referred to as “the Bureau”) existing before the commencement of\nthis Act, or a document issued in the name of the Bureau, shall be read as a\nreference to the Commission established under this Act, and all persons engaged\nby the Commission shall have the same rights, powers and remedies as existed\nin the Bureau before the commencement of this Act.",
      "page_start": 36,
      "page_end": 36,
      "content_length": 368
    },
    {
      "level": 1,
      "number": "65",
      "title": "In this Act — Interpretation",
      "content": "“automated decision-making” means a decision based solely on automated\nprocessing by automated means, without any human involvement ;\n“applicable law” means any law enacted by the National Assembly or\nHouse of Assembly of any State in Nigeria ;\n“binding corporate rules” means personal data protection policies and\nprocedures adhered to by the members of a group of firms under common\ncontrol with respect to the transfer of personal data among such members\nand containing provisions for the protecti...",
      "page_start": 37,
      "page_end": 37,
      "content_length": 946
    },
    {
      "level": 3,
      "number": "2",
      "title": "For the purpose of subsection",
      "content": "",
      "page_start": 37,
      "page_end": 37,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "1",
      "title": "—",
      "content": "",
      "page_start": 37,
      "page_end": 37,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "a",
      "title": "a person who, prior to the commencement of this Act, was an",
      "content": "officer, employee or member of staff of the Bureau shall continue in office,\nand be deemed to have been appointed under this Act on such terms and\nconditions not less favourable than that enjoyed prior to the transfer of\nservice ;",
      "page_start": 37,
      "page_end": 37,
      "content_length": 230
    },
    {
      "level": 3,
      "number": "b",
      "title": "all existing agreements and contracts currently in effect by the",
      "content": "Bureau, as it relates to the provisions of this Act shall continue ;",
      "page_start": 37,
      "page_end": 37,
      "content_length": 68
    },
    {
      "level": 3,
      "number": "c",
      "title": "all records and equipment previously belonging to or allocated for",
      "content": "use to the Bureau shall become, on the effective date of this Act, part of\nthe records and equipment of the Commission ;",
      "page_start": 37,
      "page_end": 37,
      "content_length": 120
    },
    {
      "level": 3,
      "number": "d",
      "title": "properties held immediately before the commencement of this Act",
      "content": "on behalf of the Bureau shall on the commencement of this Act, be vested\nin the Commission established under this Act ;",
      "page_start": 37,
      "page_end": 37,
      "content_length": 119
    },
    {
      "level": 3,
      "number": "e",
      "title": "any proceeding or cause of action pending or existing immediately",
      "content": "before the commencement of this Act by or against the Bureau, in respect\nof any right, interest, obligation or liability may be commenced or continued,\nas the case may be by the Commission ; and\n(f ) all orders, rules, regulations, decisions, directions, licences,\nauthorisations, certificates, consents, approvals, declarations, permits,\nregistrations, rates or other documents that are in effect before the coming\ninto effect of this Act and that are made or issued by the National Information\nTech...",
      "page_start": 37,
      "page_end": 37,
      "content_length": 1662
    },
    {
      "level": 3,
      "number": "a",
      "title": "the Government of the Federal Republic of Nigeria or any foreign",
      "content": "government ; or",
      "page_start": 38,
      "page_end": 38,
      "content_length": 15
    },
    {
      "level": 3,
      "number": "b",
      "title": "any state government, statutory authority, government authority,",
      "content": "institution, agency, department, board, commission, or organisation within\nor outside Nigeria, exercising executive, legislative, judicial, investigative,\nregulatory, or administrative functions ;\n“court” means any court of competent jurisdiction ;\n“data controller” means an individual, private entity, public Commission,\nagency or any other body who, alone or jointly with others, determines the\npurposes and means of processing of personal data ;\n“data controller or data processor of major import...",
      "page_start": 38,
      "page_end": 38,
      "content_length": 1580
    },
    {
      "level": 1,
      "number": "66",
      "title": "This Act may be cited as the Nigeria Data Protection Act,",
      "content": "2023. Citation",
      "page_start": 39,
      "page_end": 39,
      "content_length": 14
    },
    {
      "level": 3,
      "number": "a",
      "title": "genetic and biometric data, for the purpose of uniquely identifying",
      "content": "a natural person,",
      "page_start": 39,
      "page_end": 39,
      "content_length": 17
    },
    {
      "level": 3,
      "number": "b",
      "title": "race or ethnic origin,",
      "content": "",
      "page_start": 39,
      "page_end": 39,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "c",
      "title": "religious or similar beliefs, such as those reflecting conscience or",
      "content": "philosophy,",
      "page_start": 39,
      "page_end": 39,
      "content_length": 11
    },
    {
      "level": 3,
      "number": "d",
      "title": "health status,",
      "content": "",
      "page_start": 39,
      "page_end": 39,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "e",
      "title": "sex life,",
      "content": "(f ) political opinions or affiliations,",
      "page_start": 39,
      "page_end": 39,
      "content_length": 40
    },
    {
      "level": 3,
      "number": "g",
      "title": "trade union memberships, or",
      "content": "",
      "page_start": 39,
      "page_end": 39,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "h",
      "title": "other information prescribed by the Commission, as sensitive",
      "content": "personal data under section 30",
      "page_start": 39,
      "page_end": 39,
      "content_length": 30
    },
    {
      "level": 3,
      "number": "2",
      "title": ", and",
      "content": "“social security laws” means “the Employee Compensation Act, Pension\nReform Act, National Health Insurance Authority Act, National Housing Fund\nAct, Nigeria Social Insurance Trust Fund Act, Industrial Trust Fund Act or\nany other similar law.\n66. This Act may be cited as the Nigeria Data Protection Act, 2023. Citation",
      "page_start": 39,
      "page_end": 39,
      "content_length": 318
    },
    {
      "level": 1,
      "number": "1",
      "title": "Subject to the provisions of this Act, the Council may make standing",
      "content": "orders regulating the proceedings of the Council and set up any committee\nand the Council shall meet once in a quarter of a year.\nPresiding Officer",
      "page_start": 40,
      "page_end": 40,
      "content_length": 147
    },
    {
      "level": 1,
      "number": "2",
      "title": "Every meeting of the Council shall be presided over by the Chairman,",
      "content": "and where the Chairman is absent, the members present at the meeting shall\nelect one of their members to preside at the meeting.\nQuorum",
      "page_start": 40,
      "page_end": 40,
      "content_length": 135
    },
    {
      "level": 1,
      "number": "3",
      "title": "The quorum at a meeting of the Council shall be the Chairman, or in",
      "content": "an appropriate case, the person presiding at the meeting under paragraph 2 of\nthis Schedule, and four other members.",
      "page_start": 40,
      "page_end": 40,
      "content_length": 116
    },
    {
      "level": 1,
      "number": "4",
      "title": "The quorum of any committee of Council shall be determined by the",
      "content": "Council.\nVoting",
      "page_start": 40,
      "page_end": 40,
      "content_length": 15
    },
    {
      "level": 1,
      "number": "5",
      "title": "At a meeting of the Council, each member present shall be entitled to",
      "content": "one vote and any question on which a vote is required shall be determined by\na majority of votes of members present and voting but, in the case of an equal\ndivision of votes, the Chairman or the member presiding over the meeting\nshall have a casting vote.",
      "page_start": 40,
      "page_end": 40,
      "content_length": 255
    },
    {
      "level": 1,
      "number": "6",
      "title": "Where the Council seeks the advice of any person on a particular",
      "content": "nature, the Council may invite that person to attend for such period as it deems\nfit, but the person, who is invited shall not be entitled to vote at any meeting of\nthe Council and shall not count towards the quorum.\nTeleconference meeting",
      "page_start": 40,
      "page_end": 40,
      "content_length": 239
    },
    {
      "level": 1,
      "number": "7",
      "title": "In addition to meeting with all participants physically present, the Council",
      "content": "may hold or continue a meeting by the use of any means of communication by\nwhich all the participants can hear and be heard at the same time and such a\nmeeting is referred to in this item as a “teleconference meeting”.",
      "page_start": 40,
      "page_end": 40,
      "content_length": 218
    },
    {
      "level": 1,
      "number": "8",
      "title": "A member of the Council, who participates in a teleconference",
      "content": "meeting shall be taken for all purposes to have been present at the meeting.",
      "page_start": 40,
      "page_end": 40,
      "content_length": 76
    },
    {
      "level": 1,
      "number": "9",
      "title": "The Council may establish procedure for teleconference meetings",
      "content": "(including recording the minutes of such meetings) in its minutes book.",
      "page_start": 40,
      "page_end": 40,
      "content_length": 71
    },
    {
      "level": 3,
      "number": "3",
      "title": "SUPPLEMENTARY PROVISIONS RELATING TO PROCEEDINGS",
      "content": "OF THE COUNCIL\nCouncil to Regulate Proceedings\n1. Subject to the provisions of this Act, the Council may make standing\norders regulating the proceedings of the Council and set up any committee\nand the Council shall meet once in a quarter of a year.\nPresiding Officer\n2. Every meeting of the Council shall be presided over by the Chairman,\nand where the Chairman is absent, the members present at the meeting shall\nelect one of their members to preside at the meeting.\nQuorum\n3. The quorum at a meetin...",
      "page_start": 40,
      "page_end": 40,
      "content_length": 1964
    },
    {
      "level": 1,
      "number": "10",
      "title": "Subject to standing orders made by the Council under this Act, the",
      "content": "Council may appoint such number of standing and ad- hoc committees, as it\ndeems fit to consider and report on any matter with which the Council is\nconcerned.",
      "page_start": 41,
      "page_end": 41,
      "content_length": 157
    },
    {
      "level": 1,
      "number": "11",
      "title": "Every committee appointed under the provisions of paragraph 10",
      "content": "shall be presided over by a member of the Council, and shall be made up of\nsuch number of persons, as the Council may determine in each case.",
      "page_start": 41,
      "page_end": 41,
      "content_length": 141
    },
    {
      "level": 1,
      "number": "12",
      "title": "The decision of a committee shall have no effect until it is approved",
      "content": "or ratified by the Council.\nSeal of the Commission",
      "page_start": 41,
      "page_end": 41,
      "content_length": 50
    },
    {
      "level": 1,
      "number": "13",
      "title": "The affixing of the seal of the Commission shall be done and",
      "content": "authenticated by the signature of the National Commissioner or such other\nmember authorised by the Council to act for that purpose.",
      "page_start": 41,
      "page_end": 41,
      "content_length": 131
    },
    {
      "level": 1,
      "number": "14",
      "title": "A contract or instrument which, if made by a person not being a",
      "content": "body corporate, shall not be required to be under seal, may be made or executed\nby the National Commissioner or by any other officer or staff specifically\nauthorised by the National Commissioner to act for that purpose.",
      "page_start": 41,
      "page_end": 41,
      "content_length": 219
    },
    {
      "level": 1,
      "number": "15",
      "title": "A document purporting to be a contract, an instrument, or other",
      "content": "document signed or sealed on behalf of the Commission shall be received in\nevidence and shall, unless the contrary is proved, be presumed, without further\nproof, to have been so signed and sealed.\nMiscellaneous",
      "page_start": 41,
      "page_end": 41,
      "content_length": 210
    },
    {
      "level": 1,
      "number": "16",
      "title": "The validity of a proceeding of the Council or its committee is not",
      "content": "adversely affected by —\n(a) any vacancy in the membership of the Council ;\n(b) any defect in the appointment of a member of the Council, staff, or\ncommittee ; or\n(c) reason that a person not entitled to do so took part in the proceeding.",
      "page_start": 41,
      "page_end": 41,
      "content_length": 237
    },
    {
      "level": 1,
      "number": "17",
      "title": "A member of the Council or any of its committees, who has a",
      "content": "personal interest in any contract or arrangement entered into or proposed to\nbe considered by the Commission shall —\n(a) disclose to the members of the Council the nature of the interest, in\nadvance of any consideration of the matter ;\n(b) not influence or seek to influence a decision to be made in relation to\nthe matter ;",
      "page_start": 41,
      "page_end": 41,
      "content_length": 324
    },
    {
      "level": 3,
      "number": "a",
      "title": "any vacancy in the membership of the Council ;",
      "content": "",
      "page_start": 41,
      "page_end": 41,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "b",
      "title": "any defect in the appointment of a member of the Council, staff, or",
      "content": "committee ; or",
      "page_start": 41,
      "page_end": 41,
      "content_length": 14
    },
    {
      "level": 3,
      "number": "c",
      "title": "reason that a person not entitled to do so took part in the proceeding.",
      "content": "17. A member of the Council or any of its committees, who has a\npersonal interest in any contract or arrangement entered into or proposed to\nbe considered by the Commission shall —",
      "page_start": 41,
      "page_end": 41,
      "content_length": 180
    },
    {
      "level": 3,
      "number": "a",
      "title": "disclose to the members of the Council the nature of the interest, in",
      "content": "advance of any consideration of the matter ;",
      "page_start": 41,
      "page_end": 41,
      "content_length": 44
    },
    {
      "level": 3,
      "number": "b",
      "title": "not influence or seek to influence a decision to be made in relation to",
      "content": "the matter ;",
      "page_start": 41,
      "page_end": 41,
      "content_length": 12
    },
    {
      "level": 1,
      "number": "18",
      "title": "If a member of the Council discloses an interest under paragraph",
      "content": "17, the disclosure shall be recorded in the minutes of the meeting of the Council.\nI, certify, in accordance with section 2 (1) of the Acts Authentication Act,\nCap. A2, Laws of the Federation of Nigeria 2004, that this is a true copy of\nthe Bill passed by both Houses of the National Assembly.\nSANI MAGAJI TAMBAWAL, fcna\nClerk to the National Assembly\n5th Day of June,",
      "page_start": 42,
      "page_end": 42,
      "content_length": 368
    },
    {
      "level": 1,
      "number": "2023",
      "title": "EXPLANATORY MEMORANDUM",
      "content": "This Act provides a legal framework for the protection of personal information\nand establishes the Nigeria Data Protection Commission for the regulation of\nthe processing of personal information.",
      "page_start": 42,
      "page_end": 42,
      "content_length": 195
    },
    {
      "level": 3,
      "number": "c",
      "title": "take no part in any consideration of the matter ; and",
      "content": "",
      "page_start": 42,
      "page_end": 42,
      "content_length": 0
    },
    {
      "level": 3,
      "number": "d",
      "title": "be absent from the meeting or that part of the meeting during which",
      "content": "the matter is discussed.\n18. If a member of the Council discloses an interest under paragraph\n17, the disclosure shall be recorded in the minutes of the meeting of the Council.\nI, certify, in accordance with section 2",
      "page_start": 42,
      "page_end": 42,
      "content_length": 217
    },
    {
      "level": 3,
      "number": "1",
      "title": "of the Acts Authentication Act,",
      "content": "Cap. A2, Laws of the Federation of Nigeria 2004, that this is a true copy of\nthe Bill passed by both Houses of the National Assembly.\nSANI MAGAJI TAMBAWAL, fcna\nClerk to the National Assembly\n5th Day of June, 2023.\nEXPLANATORY MEMORANDUM\nThis Act provides a legal framework for the protection of personal information\nand establishes the Nigeria Data Protection Commission for the regulation of\nthe processing of personal information.",
      "page_start": 42,
      "page_end": 42,
      "content_length": 433
    }
  ]
}