Section 39 Nigeria Data Protection Act 2023

Section 39 of the Nigeria Data Protection Act 2023 is about Security, integrity, and confidentiality. It is under Part VII (Data Security) of the Act.

(1) A data controller and data processor shall implement appropriate technical and organisational measures to ensure the security, integrity and confidentiality of personal data in its possession or under its control, including
protections against accidental or unlawful destruction, loss, misuse, alteration, unauthorised disclosure, or access, taking into account —

(a) the amount and sensitivity of the personal data ;
(b) the nature, degree and likelihood of harm to a data subject that could result from the loss, disclosure, or other misuse of the personal data ;
(c) the extent of the processing ;

(d) the period of data retention ; and
(e) the availability and cost of any technologies, tools, or other measures to be implemented relative to the size of the data controller or data processor.

(2) Measures implemented under subsection (1) may include —
(a) pseudonymisation or other methods of de-identification of personal data ;
(b) encryption of personal data ;
(c) processes to ensure security, integrity, confidentiality, availability and resilience of processing systems and services ;

(d) processes to restore availability of and access to personal data in a timely manner, in the event of a physical or technical incident ;
(e) periodic assessments of risks to processing systems and services, including where the processing involves the transmission of data over an electronic communications network ;

(f ) regular testing, assessing, and evaluation of the effectiveness of the measures implemented against current and evolving risks identified ; and
(g) regular updating of the measures and introduction of new measures to address shortcomings in effectiveness, and accommodate evolving risks.