Section 46 Nigeria Data Protection Act 2023

Section 46 of the Nigeria Data Protection Act 2023 is about Complaints and investigations. It is under Part X (Enforcement) of the Act.

(1) A data subject, who is aggrieved by the decision, action, or inaction of a data controller or data processor in violation of this Act, or subsidiary legislation made under this Act may lodge a complaint with the Commission.

(2) The Commission may investigate any complaint referred to it, where it appears to the Commission that the complaint is not frivolous or vexatious.

(3) The Commission may initiate an investigation of its own accord where it has reason to believe a data controller or data processor has violated or is likely to violate this Act or any subsidiary legislation made under this Act.

(4) The Commission may, for the purpose of an investigation, order a person to —
(a) attend at a specific time and place for the purpose of being examined orally in relation to a complaint ;
(b) produce such document, record, or article, as may be required with respect to any matter relevant to the investigation, which the person is not prevented by any other written law from disclosing ; or
(c) furnish a statement in writing made under oath or an affirmation setting out all information, which may be required under the order.

(5) Where any material to which an investigation relates, consists of information stored in any document, record, minutes, mechanical or electronic device, the Commission may require the person named to produce such material or give access to the Commission to conduct an inspection on the material.

(6) For the purposes of subsection (5), the person shall ensure that the information relating to the material under investigation is visible and legible, in a structured, commonly used and machine-readable format.

(7) The Commission may, where necessary, make representations to —
(a) the data controller or data processor on behalf of a complainant ; or
(b) a complainant on behalf of the data controller or data processor.

(8) The Commission shall —
(a) establish a unit to receive and follow up on complaints from data subjects and conduct investigations ; and
(b) adopt rules and procedures on handling complaints and conducting investigations referred to it under this Act.