Section 37 Nigeria Data Protection Act 2023

Section 37 of the Nigeria Data Protection Act 2023 is about Automated decision making. It is under Part VI (Rights of a Data Subject) of the Act.

(1) A data subject shall have the right not to be subject to a decision based solely on automated processing of personal data, including profiling, which produces legal or similar significant effects concerning the data subject.

(2) Subsection (1) shall not apply, where the decision is —
(a) necessary for entering into or the performance of a contract between the data subject and a data controller ;

(b) authorised by a written law, which establishes suitable measures to safeguard the fundamental rights and freedoms, and the interests of the data subject ; or
(c) authorised by the consent of the data subject.

(3) The data controller shall implement suitable measures to safeguard the data subject’s fundamental rights, freedoms and interests, including the rights to —
(a) obtain human intervention on the part of the data controller ;
(b) express the data subject’s point of view ; and
(c) contest the decision.