A Gap Analysis of Nigeria’s Personal Data Protection Framework Against International Standards

The Nigeria Data Protection Act 2023 represents a significant legislative advance in personal data governance, yet academic analysis of whether the NDPA adequately meets international data protection standards set by the General Data Protection Regulation, the African Union Convention on Cyber Security and Personal Data Protection, and the OECD Privacy Guidelines reveals important implementation and harmonisation gaps. This study conducts a systematic gap analysis of the NDPA 2023 against three leading international frameworks using a comparative doctrinal methodology. Each NDPA provision is assessed against corresponding standards in the GDPR, AU Convention, and OECD Guidelines across eight analytical dimensions: lawful basis for processing, data subject rights, controller and processor obligations, data breach notification, cross-border transfer rules, regulatory independence, enforcement powers, and special categories of data. Results indicate that the NDPA achieves strong alignment with international standards in data subject rights provisions and consent requirements. The NDPC's institutional independence is comparatively weaker than GDPR supervisory authority standards due to limited protected tenure provisions and government appointment procedures. Cross-border data transfer adequacy decision mechanisms are less developed than GDPR equivalents. Automated decision-making safeguards are absent from the NDPA. The study fills an important gap in Nigerian data protection scholarship and concludes that targeted NDPA amendments and NDPC implementing regulations can close identified gaps without wholesale legislation revision. Recommendations include NDPC independence amendments, automated decision-making regulations, and AU Convention ratification.

Keywords: data protection, NDPA 2023, GDPR, NDPC, international standards