Section 30 Nigeria Data Protection Act 2023

Section 30 of the Nigeria Data Protection Act 2023 is about Sensitive personal data. It is under Part V (Principles and Lawful Basis Governing Processing of Personal Data) of the Act.

(1) Without prejudice to the principles set out in this Act, a data controller or data processor shall not process, or permit a data processor to process on its behalf, sensitive personal data, unless the —
(a) data subject has given and not withdrawn consent to the processing for the specific purpose or purposes for which it will be processed ;

(b) processing is necessary for the purposes of performing the obligations of the data controller or exercising rights of the data subject under employment or social security laws or any other similar laws ;
(c) processing is necessary to protect the vital interests of the data subject or of another person, where the data subject is physically or legally incapable of giving consent ;

(d) processing is carried out in the course of its legitimate activities, with appropriate safeguards, by a foundation, association, or such other non-profit organisation with charitable, educational, literary, artistic, philosophical, religious, or trade union purposes, and the —
(i) processing relates solely to the members or former members of the entity, or to persons, who have regular contact with it in connection with its purposes, and
(ii) sensitive personal data is not disclosed outside of the entity without the explicit consent of the data subject ;

(e) processing is necessary for the establishment, exercise, or defense of a legal claim, obtaining legal advice, or conduct of a legal proceeding ;

(f) processing is necessary for reasons of substantial public interest, on the basis of a law, which shall be proportionate to the aim pursued, and provides for suitable and specific measures to safeguard the fundamental
rights, freedoms and interests of the data subject ;

(g) processing is carried out for purposes of medical care or community welfare, and undertaken by or under the responsibility of a professional or similar service provider owing a duty of confidentiality ;

(h) processing is necessary for reasons of public health and provides for suitable and specific measures to safeguard the fundamental rights, freedoms and interests of the data subject ; or
(i) processing is necessary for archiving purposes in the public interest, or historical, statistical, or scientific research, in each case on the basis of a law, which shall be proportionate to the aim pursued, and provides for suitable and specific measures to safeguard the fundamental rights and freedoms and the interests of the data subject.

(2) The Commission may make regulations or issue directives prescribing —
(a) further categories of personal data that may be classified as sensitive personal data ;
(b) further grounds on which such personal data may be processed ; and
(c) safeguards that may apply.

(3) The Commission shall, in making regulations or issuing directives under subsection (2), have regard to the —
(a) risk of significant harm that may be caused to a data subject or a class of data subjects by the processing of such category of personal data ;
(b) reasonable expectation of confidentiality attached to such category of personal data ; and
(c) adequacy of protection afforded to personal data generally.