Supremacy, Coordination and the Unallocated Jurisdiction over Personal Data in Nigeria
ABSTRACT
Sections 104 of the Federal Competition and Consumer Protection Act 2018 (FCCPA) and 63 of the Nigeria Data Protection Act 2023 (NDPA) address overlapping regulatory concerns. The former gives the FCCPA priority in matters relating to competition and consumer protection, subject to the Constitution; the latter provides that the NDPA prevails where another law relating directly or indirectly to personal-data processing is inconsistent with it. Neither provision, by itself, establishes a comprehensive procedure for allocating responsibility between regulators where the same conduct raises both data-protection and consumer-protection issues.
This article examines that institutional problem through the Federal Competition and Consumer Protection Commission’s joint investigation with the Nigeria Data Protection Commission into WhatsApp’s 2021 privacy-policy changes and the resulting Final Order of 18 July 2024. It considers the significance of Article 3 of the Nigeria Data Protection Act General Application and Implementation Directive 2025, which reiterates section 63, and asks whether the existing framework adequately addresses lead-regulator designation, consultation, sequencing and disagreement between agencies.
The article argues that statutory overlap and conflict between legal rules are distinct from the allocation and coordination of regulatory powers. It proposes a structured inter-agency mechanism, grounded in a careful examination of sections 5(h) and 63 of the NDPA, Article 4 of the GAID 2025, and section 105 of the FCCPA. The proposed mechanism would identify a presumptive lead regulator, provide for early notification and consultation, and establish a process for resolving disagreement, while preserving the limits imposed by the agencies’ respective enabling statutes. Where those statutes do not authorise the necessary arrangements, legislative clarification would be required.
1. INTRODUCTION
Two Nigerian statutes claim the last word. Section 104 of the Federal Competition and Consumer Protection Act 2018 says that, despite any other law but subject to the Constitution, in all matters relating to competition and consumer protection, that Act overrides any other law.1 Section 63 of the Nigeria Data Protection Act, 2023 (NDPA) says that where another law relates directly or indirectly to the processing of personal data, and is inconsistent with the Act, the Act prevails.2
Most of the time the two never meet. But think of a messaging service that changes its privacy policy, shares user data with related companies, and makes continued access depend on accepting the change. Is that a data protection matter or a consumer protection matter? It is plainly both. The conduct is the processing of personal data, and it is equally the terms on which a service is supplied to consumers. Each statute then tells the reader that it, and not the other, governs.
This article is about what happens next, and its argument is that the difficulty has been misdiagnosed. A supremacy clause settles a clash of rules. It tells a court which rule to apply when two rules cannot both be obeyed. The problem here is different. Both statutes can be obeyed at once, because neither demands anything the other forbids. What is contested is not which rule applies but which regulator may apply it, and in what order two entitled regulators are to act. That is a clash of jurisdiction, and no supremacy clause in Nigerian law deals with it.
The distinction can be put simply. A supremacy clause is a rule about which law wins. What is needed here is a rule about whose case it is. Those are different questions, and the second has not been answered.
Part 2 sets out the proceedings against WhatsApp and Meta, which supply the facts. Part 3 examines the two supremacy clauses and how the courts have treated section 104. Part 4 turns to Article 3 of the General Application and Implementation Directive 2025 and asks what it actually supplies. Part 5 sets out what an unallocated jurisdiction costs. Part 6 proposes reform, and Part 7 concludes. The authors work from the two Acts, the Directive, and the Final Order of 18 July 2024, which they have examined. Where the account rests on reporting rather than on an instrument, that is said.
2. THE PROCEEDINGS AS A CASE STUDY
In May 2021, the Federal Competition and Consumer Protection Commission opened an inquiry into WhatsApp’s updated privacy policy, which took effect that month. The Commission’s functions include protecting consumer interests and stopping anti-competitive practices.3 The investigation was run jointly with the Nigeria Data Protection Commission.4 On the face of the Final Order, it took about three years. An Investigative Report, an Order and Notice to Show Cause and a Summons were delivered in January 2024. The Meta parties replied in March. A meeting followed in April. A proposed package of remedies was submitted and rejected by May. 5
The Final Order was issued on 18 July 2024, under the competition statute and the Nigeria Data Protection Regulation 2019. It required the restoration of user control, a compliant privacy policy, an end to data sharing until genuine consent was obtained, a return to the 2016 data sharing practices, an end to tying, written assurances, and enforcement of the proposed remedies. It also imposed costs of thirty-five thousand United States dollars and a penalty of two hundred and twenty million.6
Order 3 is the provision that matters most here. It requires any proposed policy to be approved by the NDPC under its Act and by the FCCPC under its own, and says the FCCPC will not approve a policy unless and until the NDPC’s written approval is produced.7 That is a lead-regulator rule. It sets the order of play, gives one regulator a veto, and says who goes first. It was written by one of the two regulators, in one order, for one respondent. Nothing in either statute required it, and nothing in either statute would require it in the next case.
The choice of instrument also deserves notice. The Order proceeded under the Regulation of 2019 rather than the Act of 2023 because the conduct began in May 2021. That approach may be justified by the applicable transitional provisions. It is also a reminder that the data protection part of the case was being applied by a regulator other than the one that made the instrument. The FCCPC was interpreting and enforcing a data protection instrument, in a joint investigation, while the NDPC sat beside it. Nothing in either statute describes that arrangement, allows it, or forbids it.
The transitional position adds a wrinkle that will recur. The Directive records that the Commission stopped applying the 2019 Regulation when the Directive was issued, preserving what had already been done under it.8 Conduct spanning June 2023 may therefore fall to be judged under the Regulation, under the Act, or under both in turn, depending on when each part of it happened. Add a second regulator applying a third statute with its own start date, and working out which rule governs which part of a continuing course of conduct becomes genuinely hard. A protocol allocating the lead would at least ensure the question was answered once rather than twice.
None of this is hypothetical. The Final Order records a three-year inquiry into conduct beginning in May 2021, concluded in July 2024, under an instrument replaced in March 2025. Any later proceeding on related facts would meet the same sequencing problem, and would meet it without guidance.
The sequel sharpens the point. In February 2025 the NDPC issued Final Orders in a separate matter about behavioural advertising on different platforms within the same corporate group, following a petition from a civil society organisation, under the Act rather than the Regulation.9 That proceeding involved no joint investigation. It was later compromised.10 The authors do not evaluate that outcome, and it forms no part of the argument.
What the sequence shows is this. One corporate group, two regulators, two proceedings. On the first, a joint investigation and an invented sequencing rule. On the second, unilateral action under a different statute. The difference is not explained by any provision of any instrument. It is explained by how the two regulators happened to proceed.
3. TWO SUPREMACY CLAUSES
Section 104 of the competition statute is unqualified in form. It subordinates every other law, saving only the Constitution, in all matters relating to competition and consumer protection. Section 63 of the Nigeria Data Protection Act, 2023 (NDPA) is wider in one respect: it reaches any law relating to the processing of personal data “directly or indirectly”. That adverb matters. A consumer protection statute applied to the terms on which a messaging service handles user data relates indirectly to processing, and so falls within section 63 on its own wording.
The same works in reverse. A data protection statute applied to a consumer service relates to consumer protection, and so falls within section 104. Each clause catches the other. Neither contains an exception for the other. And because the two statutes impose no conflicting duties, nothing in the competition statute allows processing that the Nigeria Data Protection Act, 2023 (NDPA) forbids, or the reverse; there is, on the usual test, no inconsistency for either supremacy clause to resolve.
It is worth pressing on the words “in all matters relating to competition and consumer protection”, because a natural reading might limit them to matters that are mainly about competition or consumers. The text does not permit that reading. The clause does not say “matters of” competition and consumer protection. It says matters relating to them, which is language of connection rather than of category. Conduct may relate to consumer protection without being only about it. Section 63 is wider still, reaching laws that relate to processing directly or indirectly. Both clauses were drafted to catch the edges of their subject, and it is at the edges that they meet.
Section 104 has received judicial attention, and the reasoning is instructive. In February 2025, the Federal High Court in Lagos held, in proceedings about the FCCPC’s authority over a telecommunications operator, that section 90 of the Nigerian Communications Act 2003 must be read together with section 104, that the later statute overrides conflicting provisions so far as they exclude the FCCPC’s oversight, and that the two regulators hold concurrent rather than exclusive jurisdiction.11 Other first-instance decisions have gone different ways on the same clause in the banking context.12
Two features of that reasoning bear on this question. The first is that the court resolved the clash by date: the later statute wins. Applied consistently, that reasoning favours the Nigeria Data Protection Act, 2023 (NDPA), which came five years after the competition statute.13 The point appears not to have been argued. The second, and more important, is that the court did not hand the jurisdiction to one regulator. It held the jurisdiction to be concurrent. On that reading, supremacy settles which rule prevails and leaves untouched the question of who applies it.
That is the right result, and it is also the difficulty. Concurrent jurisdiction is a coherent position. It becomes a practical problem only when nothing coordinates it, because two regulators holding the same ground with no allocation rule will either duplicate, clash, or improvise. The Nigerian framework has produced all three.
Nor is the difficulty limited to two regulators. The Nigerian Communications Commission regulates the handling of subscriber data under its own statute. The Central Bank of Nigeria regulates how financial institutions handle customer information. The Advertising Regulatory Council of Nigeria regulates advertising content, which in a digital setting cannot be separated from the profiling that targets it. Each of those bodies may meet a set of facts that is at once within its own remit and within the Nigeria Data Protection Act, 2023 (NDPA). The Meta proceedings involved two regulators because two regulators chose to act. A different set of facts could draw in four.
4. WHAT ARTICLE 3 SUPPLIES
The Commission has addressed this. Article 3 of the Directive is headed “Statutory Remedy in Respect of Double or Multiple Regulatory Framework on Data Protection”, which names the problem precisely.14 The Article lists four interests to be protected: informational self-determination, data sovereignty, national and cross-border data flows, and treaty obligations, and says it is imperative to uphold section 63 in all proceedings and transactions concerning the processing of personal data.15 It then sets out section 63 in full. The remaining sub-articles place the Directive below the Act and record that the 2019 Regulation is no longer applied.
The Article therefore answers a multiple-regulator problem by asserting the supremacy of one of the competing statutes. That is less a criticism of the drafting than an observation about what a directive can do. The Commission cannot, through an instrument made under its own Act, bind a regulator whose powers come from a different Act. It can state its own position, and Article 3 does. What it cannot supply, and does not claim to supply, is agreement.
The result is that that approach may be justified by the applicable transitional provisions. A controller who reads Article 3 hoping to learn which regulator will examine its conduct, in what order, and with what effect on the other, learns only that the Nigeria Data Protection Act, 2023 (NDPA) prevails over inconsistent laws. That was already true, and it does not answer the question.
It is worth saying precisely what would answer it. A coordination rule has three parts: a test for identifying the lead regulator; a duty on the other regulator to stand back, or at least to consult, before acting; and a way of settling disagreement between them. Article 3 supplies none of the three, and neither does the Act.
There is a structural reason for this, and it matters because it shows where the remedy must come from. A directive issued by one regulator under its own Act binds the persons that Act regulates. It does not bind other regulators, who take their powers from elsewhere and owe it nothing. The Commission could not have written a lead-regulator rule into the Directive even if it had wanted to, because the rule would bind nobody it needed to bind. That is not a drafting failure. It is a limit on the instrument, and it means the remedy must come either from an agreement between the regulators or from legislation.
5. THE COST OF AN UNALLOCATED JURISDICTION
The costs fall in four places. The first is on the controller, which cannot know which regulator will examine a given course of conduct, by what standard, or whether settling with one ends the matter. Order 3 is instructive here too: a respondent that had reached a position with one regulator found that position made conditional on satisfying another.
The second is on the individual. Complaints under the Act go to the Commission under section 46, and the competition statute has its own complaints machinery.16 A person harmed by conduct that engages both has no way of knowing where to complain, and no assurance that complaining to one is not complaining to the wrong body.
The third is on the regulators. Concurrent jurisdiction without coordination invites two investigations of the same conduct, at the cost of two sets of public resources. In the WhatsApp matter, that was avoided by working together. Nothing required it.
The fourth is on the coherence of the standard itself. Two regulators applying overlapping rules to similar conduct will, over time, build two bodies of practice. The Act contains a detailed sanctioning framework in section 48(6), and the competition statute contains its own.17 Where the same conduct may attract either, which mitigating framework applies depends on who moves first.
The wider point is that a framework shows its priorities through what it takes the trouble to specify. The Act specifies with care the basis on which data may leave the country, the contents of a compliance audit return, and even where on a webpage a cookie notice must appear. It does not specify which regulator examines a controller whose conduct engages two statutes. Nobody would defend that ordering of importance if it were stated openly. It has arisen because the question falls between two instruments rather than inside either.
A word should be said about double jeopardy. A related objection is whether overlapping proceedings could amount to double punishment, and it is weaker than it looks. The constitutional protection against being tried twice is confined to criminal matters, and administrative penalties imposed by different regulators under different statutes for differently described conduct do not clearly engage it.18 The difficulty described here is not that a respondent is punished twice for one wrong. It is that nothing determines whether it will be examined once, twice, or jointly.
The distinction shapes the reform. If the problem were double punishment, the answer would be a bar on second proceedings. Because the problem is unallocated jurisdiction, a bar would be the wrong tool: it would reward whichever regulator moved fastest and penalise the one that took care. What is needed is not a rule stopping the second proceeding but a rule settling, before either begins, which regulator leads and on what terms the other takes part.
There is a further practical cost that is easy to miss. Where neither regulator is obliged to go first, each has an incentive to wait and see what the other does, or to move early to secure the file. Neither instinct serves the public, and both are rational responses to an architecture that rewards whichever body acts.
6. A COORDINATION MECHANISM: EXISTING POWERS AND POSSIBLE REFORM
The materials for a coordination rule already exist across three instruments, and none of them needs amendment.
The first is section 5(h) of the Act, which requires the Commission to collaborate with any relevant ministry, department, agency, body, company, firm or person to achieve the objectives of the Act.19 The mandate is express and unqualified, and it plainly covers a sister regulator.
The second is Article 4 of the Directive, which already builds most of the machinery. It provides for cooperation with public authorities in developing sub-national and sectoral guidelines, for periodic review of those guidelines against the Act, and, where a guideline is found to work against the Act’s objectives, for that finding to be communicated and a joint review requested.20 That is a review-and-reconcile process with a defined trigger and a defined response. Its only limit is subject matter: it deals with guidelines rather than enforcement. Extending the same structure from guidance to concurrent investigation would need no new power.
The third, and the most useful, is section 105(3) of the competition statute, which already requires the Commission and sector regulators to ensure a coordinated approach, with provision in the following subsections for negotiated agreements between them.21 Nigerian law therefore already contains a template for inter-agency coordination in this very area, written by the legislature, in the same statute whose supremacy clause collides with section 63. A memorandum of understanding concluded under section 5(h) of the Act and section 105 of the competition statute would rest on express statutory authority on both sides.
What such an instrument should contain follows from the analysis. A test for identifying the lead regulator, keyed to the main character of the conduct rather than to whichever body opened a file first. A duty to notify before either regulator begins an investigation touching personal data processing by a controller within the other’s remit. A duty to consult before orders are issued. A sequencing rule of the kind Order 3 improvised, written generally so that the next respondent does not need it invented afresh. And a way of settling disagreement.
The European comparison helps here, but must be handled with care, because the analogy is imperfect in a way that matters. The one-stop-shop mechanism allocates competence between the supervisory authorities of different Member States, all applying a single Regulation, by reference to where the controller has its main establishment.22 Disagreements are settled by a body on which all the authorities sit.23 Nigeria’s fragmentation is not geographic but functional: two authorities in one country applying two statutes.24 What transfers is the architecture, not the test: the idea that competence should be allocated in advance by rule, that the authority not leading should have a right to be consulted rather than a right to proceed alone, and that a standing forum should settle disagreement.
A domestic test of that kind is workable. Where the principal issue concerns the lawfulness of processing, consent, purpose, retention, transfer, the NDPC leads. Where it is the terms on which a service is supplied to consumers, tying, misleading conduct, unfair contract terms, the FCCPC leads. Conduct that is genuinely both, as the WhatsApp policy change was, would be allocated by agreement under a standing protocol rather than by whoever opened a file first. The test will not resolve every case cleanly, but it does not need to. It needs only to produce an answer before either regulator has committed resources to a proceeding the other is also running.
Two further measures would help. The Commission’s Governing Council already includes representatives of the Ministry of Justice, the Ministry responsible for communications and digital economy, the Central Bank and a law enforcement agency, which is an existing forum for exactly this conversation.25 And publication would discipline the arrangement. The Commission is already required to keep a public register and to collect and publish information about data protection, and a published record of matters handled jointly, in sequence, or alone would give controllers and individuals the predictability the framework currently withholds.26
7. CONCLUSION
Nigeria’s data-protection and consumer-protection framework permits overlapping regulatory concerns to arise from the same conduct, but it does not clearly establish a general procedure for determining which regulator should lead, how the other should participate, or how disagreement should be resolved. The distinction is important: overlap between statutory subject matters does not necessarily establish a conflict between legal rules, and a rule giving priority to one statute does not, by itself, provide a complete procedure for coordinating the agencies that administer the law.
The WhatsApp and Meta proceedings illustrate both the possibility of joint regulatory action and the limits of relying on a case-specific arrangement. The Final Order prescribed a sequence of approvals for the parties before the regulators. The wider question is whether a comparable procedure can be established in advance, so that future cases do not depend on ad hoc agreement.
The NDPA, the GAID and the FCCPA provide a basis for examining a more structured approach to coordination. Section 5(h) of the NDPA supports collaboration by the NDPC; Article 4 of the GAID provides for cooperation and joint review in relation to guidelines; and section 105 of the FCCPA addresses concurrent jurisdiction and agreements with relevant regulators. Their combined effect must, however, be assessed against the full statutory text, including the FCCPA’s provisions concerning regulatory leadership.
The immediate reform should be a legally reviewed protocol that provides for early notification, a presumptive lead regulator, consultation, sequencing and a defined process for disagreement. It should also clarify what the non-lead regulator may do and how urgent cases are to be handled. If any element of the proposed arrangement would restrict or reallocate powers beyond what the existing statutes authorise, legislative clarification should follow.
The case for reform is therefore not that cooperation has been absent, nor that either regulator has necessarily acted improperly. It is that cooperation is more predictable when the agencies’ respective responsibilities and procedures are established in advance. A clear, lawful and transparent coordination mechanism would improve regulatory certainty while preserving the statutory mandates of both regulators.
Authors:
| Emmanuel Oluwatomilola Omole LL.B, B.L, CDPO (IIM) | Taiwo Ayobami Metilelu LL.B, B.L |
NOTES
1. Federal Competition and Consumer Protection Act, 2018 [hereinafter FCCPA 2018], s. 104: “Notwithstanding the provisions of any other law, but subject to the provisions of the Constitution of the Federal Republic of Nigeria, in all matters relating to competition and consumer protection, the provisions of this Act shall override the provisions of any other law”. See also s. 105(2).
2. Nigeria Data Protection Act, 2023 (NDPA), 2023, Act No. 37, Federal Republic of Nigeria Official Gazette No. 119, vol. 110 (1 July 2023) [hereinafter NDPA 2023], s. 63.
3. FCCPA 2018, s. 17, setting out the functions of the Commission, including the protection of consumer interests and the elimination of anti-competitive practices.
4. Federal Competition and Consumer Protection Commission, Final Order and Notice in the Matter of a Joint Investigation into Possible Violations of the Rights of Nigerian Consumers in the Provision of Contact-Based Instant Messaging Service in Nigeria … by WhatsApp LLC and Meta Platforms, Inc. under the Federal Competition and Consumer Protection Act, 2018 and the Nigeria Data Protection Regulation, 2019, dated at Abuja 18 July 2024 [hereinafter FCCPC Final Order]. The Order records that the inquiry commenced in May 2021 into WhatsApp’s Updated Privacy Policy, which became operational on 15 May 2021.
5. FCCPC Final Order, recitals 3–5, recording the conveyance of the Investigative Report, Order and Notice to Show Cause and Summons on 13 January 2024, the Meta Parties’ response of 1 March 2024, a meeting on 4 April 2024, a remedy package of 19 April 2024, and the Commission’s rejection by letter of 6 May 2024.
6. FCCPC Final Order, orders 1–9; in particular orders 8 and 9, imposing costs of USD 35,000 under s. 23(2)(f) FCCPA and a penalty of USD 220,000,000, each payable within sixty days.
7. FCCPC Final Order, Order 3, which requires that any proposed policy be approved by the Nigeria Data Protection Commission in accordance with the NDPA and by the FCCPC in accordance with the FCCPA, and provides that the FCCPC shall not approve a policy before and unless the NDPC has demonstrated its satisfaction by the Meta Parties presenting the NDPC’s approval in writing.
8. Nigeria Data Protection Commission, Nigeria Data Protection Act, 2023 (NDPA) General Application and Implementation Directive, 2025, NDPC/NDP ACT-GAID/01/2025 (20 March 2025) [hereinafter GAID 2025], art. 3(2) and (3), which subordinate the Directive to the Act and record that the Commission ceases to apply the Nigeria Data Protection Regulation 2019 as a regulatory instrument, saving anything done under it by virtue of NDPA 2023, s. 64.
9. The Commission’s Final Orders of 18 February 2025 followed a petition by the Personal Data Protection Awareness Initiative concerning behavioural advertising on Facebook and Instagram, and addressed consent, the processing of non-users’ data, compliance audit filing and cross-border transfer. The authors rely on contemporaneous reporting rather than on the instrument itself, which they have not seen, and the account in the text is confined to matters consistently reported.
10. The dispute was compromised, with terms of settlement adopted as a consent judgment of the Federal High Court, Abuja, on 3 November 2025. The terms are referred to here only as background and are not evaluated. Enforcement discretion is not the subject of this article.
11. Federal High Court, Lagos, ruling of 7 February 2025 in proceedings concerning the Commission’s authority over MTN Nigeria Communications Plc, holding that s. 90 of the Nigerian Communications Act 2003 must be read with s. 104 FCCPA, that the later enactment supersedes conflicting provisions to the extent that they exclude the Commission’s oversight, and that jurisdiction is concurrent rather than exclusive. The authors have not seen the judgment and rely on the Commission’s published account and secondary commentary.
12. Wema Bank v Federal Competition and Consumer Protection Commission, Suit No. FHC/L/450/2021 (Federal High Court), holding that s. 104 FCCPA confers jurisdiction over s. 65 of the Banks and Other Financial Institutions Act; contrast Lamfat Gas Nig. Ent. Ltd v Kuda Microfinance Bank, Suit No. LD/6869GCM/2023 (High Court of Lagos State), holding that the Commission lacks regulatory power over banking activities. The authors cite these as illustrating first-instance divergence and have not examined either judgment.
13. On the ordinary approach to implied repeal and later enactments, see the authorities relied upon in the proceedings referred to above. The NDPA 2023 postdates the FCCPA 2018 by five years, so that reasoning of the kind applied to the Nigerian Communications Act 2003 would, if applied consistently, favour the NDPA in a data protection matter. The point appears not to have been tested.
14. GAID 2025, art. 3, headed “Statutory Remedy in Respect of Double or Multiple Regulatory Framework on Data Protection”.
15. GAID 2025, art. 3(1)(a)–(d), which identifies informational self-determination, data sovereignty, national and cross-border data flows, and treaty obligations as the interests to be secured, before reproducing s. 63 of the Act.
16. NDPA 2023, s. 46(1)–(3), on complaints and own-motion investigation; s. 47, on compliance orders; and s. 48, on enforcement orders.
17. NDPA 2023, s. 48(6), which directs the Commission to consider the nature, gravity and duration of the infringement, the purpose of the processing, the number of data subjects involved, the level of damage and mitigation, intent or negligence, the degree of cooperation, and the types of personal data involved. The FCCPA contains its own penalty regime and its own mitigating framework.
18. Constitution of the Federal Republic of Nigeria, 1999 (as amended), s. 36(9), on the plea of previous acquittal or conviction. The doctrine is confined to criminal proceedings and does not, in terms govern successive administrative penalties, which is itself part of the difficulty described here.
19. NDPA 2023, s. 5(h), by which the Commission is to collaborate with any relevant ministry, department, agency, body, company, firm or person for the attainment of the objectives of the Act.
20. GAID 2025, art. 4(2)–(4), providing for cooperation with public authorities in the development of sub-national or sectoral guidelines, periodic review of such guidelines for conformity with the Act, and, where a guideline negates the objectives of the Act, communication of that determination and a request for joint review.
21. FCCPA 2018, s. 105(3), requiring the Commission and any sector regulator to ensure a coordinated approach in matters affecting competition and consumer protection; and ss. 105(4)–(6), on negotiated agreements between the Commission and sector regulators. See also s. 47(2), on review of the exercise of power by a sector regulator in matters affecting competition.
22. Regulation (EU) 2016/679 (General Data Protection Regulation) [hereinafter GDPR], art. 56, which designates the supervisory authority of the main or single establishment as lead supervisory authority for cross-border processing.
23. GDPR, art. 60, on cooperation between the lead authority and concerned authorities; and art. 65, on binding dispute resolution by the European Data Protection Board.
24. GDPR, art. 4(23), defining cross-border processing; and recital 127, on the allocation of competence.
25. NDPA 2023, s. 8(1)(c), by which the Governing Council includes representatives of the Federal Ministry responsible for Justice, the Federal Ministry responsible for communications and digital economy, the Central Bank of Nigeria and a law enforcement agency.
26. NDPA 2023, s. 44(4), requiring the Commission to maintain and publish on its website a register of duly registered data controllers and data processors of major importance; and s. 5(l), on the collection and publication of information with respect to personal data protection.
This update has been prepared by the Data Protection and Privacy team at Omole, Komolafe and Partners.
DISCLAIMER: This article is intended for information purposes only and does not constitute legal advice. It does not create, and shall not be construed as creating, a client/attorney relationship between readers and the firm or any author. Specific legal advice should be sought in relation to particular circumstances.
