Nigeria Data Protection Act s. 37 — right against solely-automated decisions, with a duty to provide human intervention on request
Binds Data controllers and data processors within the scope of s. 2(2): those domiciled in, resident in, or operating in Nigeria; any processing of personal data that occurs within Nigeria; and controllers or processors not domiciled, resident or operating in Nigeria that process personal data of a data subject in Nigeria. Section 2(1) applies the Act to processing whether by automated means or not, and s. 3(1) carves out processing carried out solely for personal or household purposes. The s. 37 right binds any controller taking a solely-automated decision with legal or similar significant effect, irrespective of size. A narrower registration and governance tier sits above it: a data controller or data processor “of major importance” — defined in s. 65 as one domiciled, resident or operating in Nigeria that processes personal data of more than such number of data subjects in Nigeria as the Commission may prescribe, or such other class the Commission may designate as processing data of particular value or significance to the economy, society or security of Nigeria — must register with the Commission under s. 44(1) within six months after the commencement of the Act or on becoming one, and must designate a Data Protection Officer under s. 32(1). Impact tier: all entities.. Section 37 of the Nigeria Data Protection Act, 2023 (Act No. 37 of 2023) carries Nigeria's operative automated-decision rule, in Part VI (rights of a data subject). Subsection (1) gives a data subject the right not to be subject to a decision based solely on automated processing of personal data, including profiling, which produces legal or similar significant effects concerning the data subject. Subsection (2) disapplies that right where the decision is necessary for entering into or the performance of a contract between the data subject and a data controller, is authorised by a written law which establishes suitable measures to safeguard the fundamental rights and freedoms and the interests of the data subject, or is authorised by the consent of the data subject. Subsection (3) is the operative duty on the controller: where an exception is relied on, the data controller shall implement suitable measures to safeguard the data subject's fundamental rights, freedoms and interests, including the rights to obtain human intervention on the part of the data controller, to express the data subject's point of view, and to contest the decision. Section 65 defines “automated decision-making” as a decision based solely on automated processing by automated means, without any human involvement. Section 36(3) separately gives a right to object at any time to processing for direct marketing purposes, which includes profiling to the extent that it is related to such direct marketing, and s. 36(4) requires processing for those purposes to stop on objection.
Commencement is stated on the face of the enacted Act: the gazetted text prints “[12th Day of June, 2023]” immediately above the enacting formula, and s. 37 carries no deferred or separately-appointed commencement, so the section has been in force since 12 June 2023. The Act was published by The Federal Government Printer, Lagos as a supplement to the Federal Republic of Nigeria Official Gazette No. 119, Vol. 110 of 1 July 2023, Government Notice No. 82, as Act No. 37, at pages A719 to A758. Section 37 follows the GDPR Art. 22 shape and is the closest of the tracker's three African provisions to it: unlike the South African za-popia-s71, which offers only representations plus disclosure of the underlying logic, Nigeria expressly grants human intervention, the right to express a point of view and the right to contest the decision; unlike the Kenyan ke-dpa-s35 it imposes no affirmative written-notification duty when a solely-automated decision is taken, and confers no express right to demand a fresh non-automated decision. Source access: the Nigeria Data Protection Commission is the statutory supervisory authority established by s. 4 of the Act and ndpc.gov.ng is the only official host that serves the Act text, but the host returns HTTP 403 (nginx, not a challenge page) to every non-browser client from this network, on the apex domain and on every subdomain except the services portal; nass.gov.ng's publications register does not carry the Act, and nigeriagazette.gov.ng does not resolve. The text cited here was therefore read from the Internet Archive's byte-for-byte capture of the NDPC-hosted gazette PDF at the source_url (capture of 31 May 2025, origin Last-Modified 1 March 2024): https://web.archive.org/web/20250531105744/https://ndpc.gov.ng/wp-content/uploads/2024/03/Nigeria_Data_Protection_Act_2023.pdf. No secondary or NGO copy was relied on. Not yet verified: the NDPC General Application and Implementation Directive 2025 (issued 20 March 2025) may add implementation detail on automated decision-making; every archived capture of it replays 503, so it is excluded from this entry and left for a later check.
Stated maximum penalty — Section 48 governs sanctions. After an investigation under s. 46, the Commission may order the controller or processor to remedy the violation, to compensate a data subject who has suffered injury, loss or harm, to account for the profits realised from the violation, or to pay a penalty or remedial fee (s. 48(2)). Under s. 48(3)–(5) that penalty may be up to the “higher maximum amount” for a data controller or data processor of major importance, being the greater of ₦10,000,000 and 2% of its annual gross revenue in the preceding financial year, or the “standard maximum amount” for one not of major importance, being the greater of ₦2,000,000 and 2% of that revenue. Failure to comply with a compliance order made under s. 47 is a separate offence under s. 49, punishable on conviction by a fine of up to the same higher or standard maximum amount, or imprisonment for a term not more than one year, or both. Section 51 gives a data subject who suffers injury, loss or harm a civil action for damages, and s. 50 allows an application to court for judicial review of a Commission order within 30 days.