Section 44 Nigeria Data Protection Act 2023
Section 44 of the Nigeria Data Protection Act 2023 is about Registration of data controllers and data processors of major importance. It is under Part IX (Registration and Fees) of the Act.
(1) Data controllers and data processors of major importance shall register with the Commission within six months after the commencement of the Act or on becoming a data controller or data processor of major
importance.
(2) Registration under subsection (1) shall be made by notifying the Commission of —
(a) the name and address of the data controller or data processor, and name and address of the data protection officer of the data controller or data processor ;
(b) a description of personal data and the categories and number of data subjects to which the personal data relate ;
(c) the purposes for which personal data is processed ;
(d) the categories of recipients to whom the data controller or data processor intends or is likely to disclose personal data ;
(e) the name and address, or name and address of any representative of any data processor operating directly or indirectly on its behalf ;
(f ) the country to which the data controller or data processor intends, directly or indirectly to transfer the personal data ;
(g) a general description of the risks, safeguards, security measures and mechanisms to ensure the protection of the personal data ; and
(h) any other information required by the Commission.
(3) A data controller or data processor of major importance shall notify the Commission of any significant change to the information submitted under subsection (2) within 60 days after such change.
(4) The Commission shall maintain and publish on its website a register of duly registered data controllers and data processors of major importance.
(5) A data controller or data processor shall be removed from the register of the Commission, where it notifies the Commission that it has ceased to operate as a data controller or data processor of major importance.
(6) The Commission may exempt a class of data controllers or data processors of major importance from the registration requirements of this section, where it considers such requirement to be unnecessary or disproportionate.
