Nigeria NDPA & Cross-Border Transfer Review

This document reviews the applicability of the Nigeria Data Protection Act, 2023 (NDPA) to DuruVault and summarizes cross-border transfer considerations, because DuruVault supports users in Nigeria. It is a working review for legal counsel, not a determination of compliance or registration status.

1. Applicability

The NDPA may apply where DuruVault processes the personal data of data subjects in Nigeria. Where it applies, DuruVault seeks to process personal data on a lawful basis, honor data-subject rights, and apply appropriate security measures consistent with the NDPA and our Privacy Policy and DPA.

2. Lawful Bases & Rights

Lawful bases may include consent, contract performance, legal obligation, legitimate interests, and other bases recognized by the NDPA. Nigerian data subjects may exercise rights such as access, rectification, deletion, and objection, consistent with the NDPA and our Privacy Policy.

3. Controller/Processor Obligations

Depending on the processing, DuruVault may act as a data controller or data processor. Obligations may include maintaining records of processing, implementing security measures, and managing subprocessors (see /legal/subprocessors).

4. Cross-Border Transfers

Personal data of Nigerian users may be processed or stored in the United States and other countries where DuruVault's providers operate. Cross-border transfers rely on mechanisms recognized by the NDPA (e.g., adequacy, appropriate contractual safeguards, or the data subject's informed consent), consistent with applicable law.

5. Items Flagged for Legal Counsel

The following require confirmation by qualified counsel and owner action, and are NOT asserted as completed:

• Whether DuruVault must register with the Nigeria Data Protection Commission (NDPC) and any data-controller/processor-of-major-importance thresholds.
• Appointment of a Data Protection Officer and/or a Nigerian representative, if required.
• Execution of NDPA-compliant transfer instruments and any data-protection impact assessment obligations.