Nigeria Data Protection Regulation (NDPR)

Part Two: principles, consent, policy, security and transfers – Nigeria Data Protection Regulation (NDPR)

Nigeria Data Protection Regulation (NDPR) 2.1(2)-(3): Duty of care and accountability of whoever holds personal data

Anyone entrusted with or in possession of a data subject's personal data owes that data subject a duty of care and is accountable for their acts and omissions in processing, in line with the Regulation's principles.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Other controls in Part Two: principles, consent, policy, security and transfers – Nigeria Data Protection Regulation (NDPR)

2.1(1)(a) Specific, legitimate and lawful purpose; limits on further processing
2.1(1)(b) Adequate and accurate data, processed without prejudice to human dignity
2.1(1)(c) Store personal data only as long as reasonably needed
2.1(1)(d) Secure personal data against foreseeable hazards and breaches
2.11 Transfer abroad only to jurisdictions with an adequacy decision, under HAGF supervision
2.12 Transfers without adequacy only on the six derogations, with clear warnings
2.2 Process only on one of the five lawful bases
2.3(1) Tell the data subject the specific purpose before obtaining data

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All Nigeria Data Protection Regulation (NDPR) controls