As data protection regulations continue to evolve in Nigeria, organizations must ensure that their contractual engagements involving personal data strictly comply with the provisions of the Nigeria Data Protection Act (NDPA), 2023, and the supporting General Application and Implementation Directive (GAID) 2025.
One critical area of focus is the reliance on contracts as a lawful basis for processing personal data. Article 21 of the GAID provides guidance on how contracts between data subjects and data controllers or processors should be structured to uphold data protection principles and ensure legal compliance.
1. Processing Personal Data at the Pre-Contract Stage
The GAID acknowledges that some level of data processing may be necessary before a contract is formalized. Specifically, Article 21(1) permits a data controller or processor to process a data subject’s personal information during the due diligence stage.
For instance: A fintech company reviewing a loan application may process the applicant’s personal data such as credit history, bank statements, or identification documents before offering a loan agreement.
However, this data processing must be limited to what is necessary for assessing the potential contract.
2. Data Retention Where the Contract Fails
According to Article 21(2), where a contract does not materialize, any personal data collected during the preliminary stage must be destroyed within six (6) months, unless there is a justifiable legal ground to retain the information such as in anticipation of a legal claim.
Thus, If a recruitment agency collects CVs during interviews but does not hire a candidate, it must delete those records within six months unless it is retaining them for documentation in case of a future employment dispute.
This provision enforces the Nigeria Data Protection Act data minimization and storage limitation principles, ensuring that personal data is not kept indefinitely without lawful justification.
3. Contracts Must Include a Termination Clause
Article 21(3) requires that any contract involving the processing of personal data must contain provisions for early termination. This ensures that data subjects have the flexibility to exit the contract if needed and that the parties understand how personal data will be handled if the contract ends prematurely.
An e-learning platform that collects user data for course subscriptions must include a clause that allows users to terminate their subscriptions and request deletion or anonymization of their personal data.
4. Jurisdiction Cannot Be Ousted by Contract
In alignment with Section 46 of the Nigerian Constitution and Section 34 of the NDPA, Article 21(4) of the GAID states that any contract clause that attempts to oust the jurisdiction of Nigerian courts or the Nigeria Data Protection Commission (NDPC) is void.
A social media company operating in Nigeria cannot include a clause in its user agreement stating that only foreign courts have jurisdiction over data protection disputes with Nigerian users. Such a clause would be legally unenforceable.
This protects the rights of data subjects and affirms the NDPC’s authority to investigate and enforce data protection obligations in Nigeria.
5. ADR Clauses Are Permissible – But Not Absolute
While parties cannot waive their right to judicial or regulatory redress, Article 21(5) allows contracts to include Alternative Dispute Resolution (ADR) mechanisms, such as arbitration or mediation, for resolving data-related issues.
A healthcare provider may include a clause requiring disputes about data breaches to first go through mediation before court litigation. However, this clause cannot prevent the data subject from reporting the incident to the NDPC or pursuing their rights in court.
Conclusion:
Article 21 of the GAID complements the NDPA by establishing clear expectations for how personal data should be handled in contractual relationships. Organizations must:
- Ensure lawful processing at all stages of the contract lifecycle
- Respect data minimization and deletion timelines
- Preserve the legal rights of data subjects
- Avoid any attempt to circumvent Nigerian law
- Incorporate fair dispute resolution mechanisms
As data privacy becomes central to trust in digital and commercial relationships, integrating these requirements into contracts is not just a legal obligation but a business necessity.
Hannah Adeyemi
For: The LegalPrenuer LP
You can send an email to hannah@thelegalpreneur.com.ng
For advert enquiries call 0813 776 2516.
Send your press release and articles to: hannah@thelegalpreneur.com.ng