Section 41 Nigeria Data Protection Act 2023

Section 41 of the Nigeria Data Protection Act 2023 is about Basis for cross-border transfer of personal data. It is under Part VIII (Cross-border Transfers of Personal Data) of the Act.

(1) A data controller or data processor shall not transfer or permit personal data to be transferred from Nigeria to another country, unless —
(a) the recipient of the personal data is subject to a law, binding corporate rules, contractual clauses, code of conduct, or certification mechanism that affords an adequate level of protection with respect to the personal data in accordance with this Act ; or
(b) one of the conditions set out in section 43 of this Act applies.

(2) A data controller or data processor shall record the basis for transfer of personal data to another country under subsection (1) and the adequacy of protection under section 42 of this Act.

(3) The Commission may make regulations requiring data controllers and data processors to notify it of the measures in place under subsection (1) and to explain their adequacy in terms of section 42 of this Act.

(4) The Commission may, by regulations, designate categories of personal data that are subject to additional specified restrictions on transfer to another country based on the nature of such personal data and risks to data subjects.