Data Processing Agreement (Nigeria)
NDPA 2023 Compliant
DATA PROCESSING AGREEMENT
Nigeria Data Protection Act 2023 | NDPC Framework | CAMA 2020
THIS DATA PROCESSING AGREEMENT ("Agreement") is made on [Agreement Date]
BETWEEN:
(1) [Controller Name] (RC: [Controller RC Number]) of [Controller Address] (hereinafter referred to as the "Data Controller"); AND
(2) [Processor Name] (RC: [Processor RC Number]) of [Processor Address] (hereinafter referred to as the "Data Processor").
The Data Controller and the Data Processor are hereinafter collectively referred to as "the Parties".
RECITALS
A. The Data Controller is responsible for the processing of personal data in connection with its business operations and determines the purposes and means of that processing.
B. The Data Processor provides services to the Data Controller under a separate agreement, in the course of which the Data Processor processes personal data on behalf of the Data Controller.
C. Section 37 of the Nigeria Data Protection Act 2023 (NDPA) requires that processing by a data processor on behalf of a data controller be governed by a binding contract setting out the mandatory provisions of NDPA Section 37(3).
D. The Parties enter into this Agreement to comply with NDPA 2023 Section 37 and to document their respective obligations in respect of the processing of personal data.
1. DEFINITIONS
1.1 In this Agreement: "NDPA" means the Nigeria Data Protection Act 2023; "NDPC" means the Nigeria Data Protection Commission established under the NDPA; "Personal Data" has the meaning given in the NDPA; "Processing" has the meaning given in the NDPA; "Personal Data Breach" has the meaning given in the NDPA; "Data Subject" means an identified or identifiable natural person to whom the personal data relates; "Sub-Processor" means any third party engaged by the Data Processor to carry out processing activities on behalf of the Data Controller.
2. PROCESSING DETAILS
2.1 Subject matter and purpose: The Data Processor shall process Personal Data for the following purpose: [Processing Purpose].
2.2 Categories of Personal Data: [Data Categories].
2.3 Categories of Data Subjects: [Data Subject Categories].
2.4 Nature of processing operations: [Processing Nature].
2.5 Duration: The Data Processor shall process Personal Data for [Processing Duration].
3. DATA PROCESSOR OBLIGATIONS
3.1 Instructions: The Data Processor shall process Personal Data only on documented instructions from the Data Controller, unless required to do so by applicable Nigerian law. The Data Processor shall immediately inform the Data Controller if, in its opinion, an instruction infringes the NDPA or other applicable data protection law.
3.2 Confidentiality: The Data Processor shall ensure that all persons authorised to process Personal Data under this Agreement are subject to enforceable confidentiality obligations, either by contract or by statute.
3.3 Security: The Data Processor shall implement and maintain the following technical and organisational security measures in accordance with NDPA 2023 Section 24: [Security Measures].
3.4 Data Subject Rights: The Data Processor shall assist the Data Controller in fulfilling its obligations to respond to requests from Data Subjects exercising their rights under the NDPA (including rights of access, correction, deletion, portability, and objection), within the timelines required by the NDPA.
3.5 Security Assistance: The Data Processor shall assist the Data Controller in ensuring compliance with its security obligations under NDPA Section 24 and its data breach notification obligations under NDPA Section 40.
3.6 Data Return and Deletion: At the choice of the Data Controller, the Data Processor shall delete or return all Personal Data to the Data Controller after the end of the provision of processing services, and shall delete existing copies unless Nigerian law requires storage of the Personal Data. Confirmation of deletion shall be provided in writing within [Data Return/Deletion Timeline].
3.7 Audit: The Data Processor shall make available to the Data Controller all information necessary to demonstrate compliance with the obligations laid down in the NDPA and this Agreement, and shall allow for and contribute to audits and inspections conducted by the Data Controller or a third-party auditor mandated by the Data Controller, upon reasonable written notice.
4. SUB-PROCESSORS
4.1 Authorisation: The Data Processor shall not engage a Sub-Processor without [Sub-Processor Authorisation Type] authorisation from the Data Controller.
4.2 Sub-Processor Obligations: Where the Data Processor engages a Sub-Processor, the Data Processor shall impose on the Sub-Processor the same data protection obligations as set out in this Agreement, by way of a written contract. Where the Sub-Processor fails to fulfil its data protection obligations, the Data Processor shall remain fully liable to the Data Controller for the performance of the Sub-Processor's obligations.
4.3 Sub-Processor List: The Data Processor shall maintain an updated list of all Sub-Processors engaged in the processing and shall provide a copy to the Data Controller upon request.
5. PERSONAL DATA BREACH NOTIFICATION
5.1 The Data Processor shall notify the Data Controller without undue delay, and in any event within [Breach Notification Period] of becoming aware of a Personal Data Breach involving Personal Data processed under this Agreement.
5.2 The notification shall include: a description of the nature of the breach; the categories and approximate number of Data Subjects concerned; the categories and approximate number of Personal Data records concerned; the likely consequences of the breach; and the measures taken or proposed to address the breach and mitigate its effects.
5.3 The Data Controller shall, where required, notify the NDPC within 72 hours of becoming aware of the breach under NDPA 2023 Section 40.
6. CROSS-BORDER DATA TRANSFERS
6.1 The Data Processor shall not transfer Personal Data outside Nigeria except with the prior written authorisation of the Data Controller and only where an adequate transfer mechanism exists under NDPA 2023 Section 43 — including an NDPC adequacy determination, appropriate safeguards (standard contractual clauses or binding corporate rules), or a specific derogation.
7. LIABILITY AND INDEMNITY
7.1 Where the Data Processor is responsible for a breach of the NDPA, the Data Processor shall be liable to the Data Controller for all losses, claims, fines, penalties, and costs incurred by the Data Controller as a result of that breach, including any administrative fines imposed by the NDPC.
7.2 Where the Data Processor processes Personal Data outside the instructions of the Data Controller or in violation of the NDPA, the Data Processor shall be treated as an independent Data Controller for that processing and shall bear direct liability.
8. GOVERNING LAW AND DISPUTE RESOLUTION
8.1 This Agreement is governed by the laws of Nigeria, including the Nigeria Data Protection Act 2023 and the laws applicable in [Governing Law].
8.2 Any dispute arising out of or in connection with this Agreement shall be referred to arbitration under the Arbitration and Conciliation Act 2023 or submitted to the jurisdiction of the Federal High Court of Nigeria.
Data Controller
________________
Signature
Data Processor
________________
Signature
What Is a Data Processing Agreement (Nigeria)?
A Data Processing Agreement in Nigeria sets out the rights, duties and consideration binding the parties to it.
Section 37 of the NDPA 2023 requires that where a data controller engages a data processor, the processing must be governed by a binding contract or other legal act that stipulates: the subject matter, duration, nature, and purpose of the processing; the type of personal data and categories of data subjects involved; the obligations and rights of the data controller; and specific mandatory processor obligations set out in Section 37(3) of the NDPA.
The mandatory processor obligations under NDPA 2023 Section 37(3) include: processing personal data only on documented instructions from the data controller; binding all persons authorised to process the data to confidentiality; implementing appropriate technical and organisational security measures under Section 24 of the NDPA; not engaging sub-processors without prior specific or general written authorisation from the data controller; assisting the controller in fulfilling data subject rights requests; assisting in meeting security and incident notification obligations; deleting or returning all personal data at the end of the processing relationship; and providing all information necessary to demonstrate compliance with the NDPA.
The NDPA 2023 reflects the international standard established by the EU General Data Protection Regulation (GDPR) Article 28, which also requires a binding contract between controllers and processors. Nigerian organisations working with international clients or partners will find the NDPA DPA requirements substantially compatible with GDPR Article 28 requirements, enabling a single contract to satisfy both frameworks.
The Nigeria Data Protection Commission (NDPC), established under the NDPA, can investigate the terms and implementation of data processing agreements and impose administrative fines on both data controllers and data processors that fail to comply with NDPA Section 37. Both parties to a DPA share compliance obligations — a data processor that acts outside the controller's instructions or in violation of NDPA obligations becomes an independent data controller for the non-compliant processing and bears direct liability.
The legal framework governing the Data Processing Agreement (Nigeria) in Nigeria draws on several key statutes and regulatory bodies. Under Nigerian law, the Companies and Allied Matters Act 2020 (CAMA) regulates corporate entities through the Corporate Affairs Commission (CAC). The Labour Act (Cap L1 LFN 2004) and the National Industrial Court of Nigeria (NICN) govern employment disputes. The Nigeria Data Protection Regulation (NDPR) 2019 and the Nigeria Data Protection Commission (NDPC) protect personal data. The Federal Inland Revenue Service (FIRS) administers tax obligations under the Companies Income Tax Act. The Federal High Court and state High Courts have jurisdiction over civil matters. Parties executing a Data Processing Agreement (Nigeria) in Nigeria should confirm the document reflects current law, including any amendments enacted since the original drafting date. The Companies and Allied Matters Act (CAMA) 2020 sets the foundational requirements.
When Do You Need a Data Processing Agreement (Nigeria)?
A Nigeria Data Processing Agreement is required under NDPA 2023 Section 37 whenever a data controller engages any third party to process personal data on its behalf. The obligation applies regardless of the size of the processing activity or the value of the underlying commercial relationship.
Cloud service providers: any Nigerian company that stores customer or employee personal data in a cloud platform (AWS, Microsoft Azure, Google Cloud, or Nigerian cloud providers) must have a DPA with the cloud provider, as the cloud provider is processing personal data on the company's behalf. Most major cloud providers offer their own standard DPA terms; Nigerian data controllers should review these against NDPA 2023 requirements.
Payroll and HR service providers: companies that outsource payroll processing, recruitment, or HR management to third-party service providers must have a DPA, as these activities involve processing employees' personal data (salary, bank details, tax identification numbers, health insurance data) by the service provider.
Marketing and analytics platforms: companies that share customer data with email marketing platforms, CRM systems, data analytics providers, or advertising platforms must have a DPA, as these platforms process personal data on behalf of the company for marketing, analytics, or advertising purposes.
Financial service providers using third-party technology: banks, FinTech companies, and insurance companies that use third-party technology platforms — core banking software providers, payment processing platforms, credit bureau data processors — must have DPAs with each processor. The CBN outsourcing guidelines additionally require formal contracts with IT service providers handling customer data.
NGOs and development organisations that share beneficiary data with third-party programme management platforms or with sub-grantee organisations processing data on the NGO's behalf require DPAs to comply with NDPA 2023 and with donor data protection requirements.
Parties in Nigeria should prepare a Data Processing Agreement (Nigeria) proactively rather than waiting for a dispute to arise. Courts interpret agreements based on the written terms rather than oral representations. Under Nigerian law, the Companies and Allied Matters Act 2020 (CAMA) regulates corporate entities through the Corporate Affairs Commission (CAC). The Labour Act (Cap L1 LFN 2004) and the National Industrial Court of Nigeria (NICN) govern employment disputes. The Nigeria Data Protection Regulation (NDPR) 2019 and the Nigeria Data Protection Commission (NDPC) protect personal data. The Federal Inland Revenue Service (FIRS) administers tax obligations under the Companies Income Tax Act. The Federal High Court and state High Courts have jurisdiction over civil matters. Where the transaction involves regulated activities, prior approval from the relevant authority may be required before execution.
What to Include in Your Data Processing Agreement (Nigeria)
A Nigeria Data Processing Agreement must contain the following mandatory elements specified in NDPA 2023 Section 37 and best practice provisions.
Parties and recitals: identification of the data controller (the party determining the purposes and means of processing) and the data processor (the party processing on behalf of the controller), with their CAMA 2020 RC numbers, TIN numbers, registered addresses, and a brief description of the commercial relationship giving rise to the DPA.
Subject matter, duration, nature, and purpose of processing: a clear description of what personal data will be processed (data categories), who the data subjects are (employees, customers, beneficiaries), the specific processing operations to be carried out, and the business purpose for which processing is being carried out. The duration of the DPA must align with the duration of the underlying commercial agreement.
Processing only on controller instructions: an express provision requiring the processor to process personal data only on documented instructions from the controller, and to notify the controller immediately if it believes an instruction violates the NDPA 2023 or other applicable law. This is a mandatory NDPA Section 37(3)(a) requirement.
Confidentiality obligations: a requirement that all persons who process the personal data under the agreement are bound by confidentiality obligations under NDPA Section 37(3)(b) — either by statute (for public officers) or by contract.
Technical and organisational security measures: specification of the security measures the processor must implement under NDPA Section 24, which may include encryption at rest and in transit, access controls, penetration testing requirements, ISO 27001 certification, and incident detection and response capabilities.
Sub-processor provisions: terms governing the processor's use of sub-processors — whether general or specific authorisation is required; the requirement that sub-processors be bound by the same data protection obligations as the processor; and the processor's liability for sub-processor non-compliance under NDPA Section 37(3)(d).
Data subject rights assistance: the processor's obligation to assist the controller in responding to data subject rights requests (access, correction, deletion, portability, objection) within the timelines required by the NDPA.
Data breach notification: the processor's obligation to notify the controller without undue delay (and at most within 24 hours of becoming aware) of any personal data breach, to enable the controller to meet its 72-hour NDPC notification obligation under NDPA Section 40.
Data return and deletion: procedures and timelines for returning or securely deleting all personal data at the end of the processing relationship, with written confirmation of deletion, in compliance with NDPA data retention obligations.
Audit rights: the controller's right to audit the processor's compliance with the DPA, either directly or through an appointed third-party auditor.
Additional compliance elements for a Data Processing Agreement (Nigeria) used in Nigeria include: Under Nigerian law, the Companies and Allied Matters Act 2020 (CAMA) regulates corporate entities through the Corporate Affairs Commission (CAC). The Labour Act (Cap L1 LFN 2004) and the National Industrial Court of Nigeria (NICN) govern employment disputes. The Nigeria Data Protection Regulation (NDPR) 2019 and the Nigeria Data Protection Commission (NDPC) protect personal data. The Federal Inland Revenue Service (FIRS) administers tax obligations under the Companies Income Tax Act. The Federal High Court and state High Courts have jurisdiction over civil matters. Forms-legal.com provides this template as a starting point for Nigeria-compliant documentation.
Sources & Citations
Statutory citations link to official government sources.
- GDPR Article 28EU – GDPR
Cite this page
Reference this free template in an article, syllabus, or research note:
Forms Legal. (2026). Data Processing Agreement (Nigeria) (Nigeria) [Legal document template]. Forms Legal. https://forms-legal.com/nigeria/business/contracts/data-processing-agreement-nigeria
"Data Processing Agreement (Nigeria) (Nigeria)." Forms Legal, 2026, https://forms-legal.com/nigeria/business/contracts/data-processing-agreement-nigeria.
@misc{formslegal-data-processing-agreement-nigeria,
author = {{Forms Legal}},
title = {Data Processing Agreement (Nigeria) (Nigeria)},
year = {2026},
howpublished = {\url{https://forms-legal.com/nigeria/business/contracts/data-processing-agreement-nigeria}},
note = {Free legal document template. Based on Companies and Allied Matters Act (CAMA) 2020}
}
Frequently Asked Questions
Yes, a Data Processing Agreement (DPA) is mandatory under Section 37 of the Nigeria Data Protection Act 2023 (NDPA) whenever a data controller engages a third party (data processor) to process personal data on its behalf. The NDPA requires that all processing by a processor on behalf of a controller be governed by a binding contract that includes the specific mandatory provisions listed in Section 37(3) of the NDPA. Processing personal data through a third party without a written DPA is a violation of the NDPA, and both the data controller and the data processor may face administrative sanctions from the Nigeria Data Protection Commission (NDPC). For data controllers that were previously subject to the Nigeria Data Protection Regulation (NDPR) 2019 — which also required data processing agreements — the NDPA 2023 continues and strengthens this obligation. The transition to the NDPA means that DPAs previously drafted under the NDPR framework should be reviewed and updated to ensure they include all mandatory provisions of NDPA Section 37(3) and reflect the broader rights and obligations introduced by the NDPA. The NDPC has powers to require data controllers to produce DPAs during investigations and audits, and the absence of a compliant DPA is a significant aggravating factor in NDPC enforcement proceedings.
Under the Nigeria Data Protection Act 2023 (NDPA), a data controller is a natural or legal person, public authority, or other body that determines the purposes (the 'why') and means (the 'how') of processing personal data. A data processor is a natural or legal person that processes personal data on behalf of and under the instructions of a data controller. The distinction determines which party bears primary responsibility for NDPA compliance. The data controller bears the primary obligation to ensure that processing has a lawful basis, that data subjects are informed of their rights, that security measures are appropriate, and that data subject rights requests are fulfilled. The data processor must process personal data only on the controller's documented instructions, implement security measures, and support the controller's compliance obligations. The same organisation can be a data controller for some data and a data processor for other data — for example, an HR outsourcing company is a data controller for its own employee data but a data processor for the employee data of its client companies that it manages on their behalf. Where a processor acts outside the controller's instructions or independently determines processing purposes, the processor becomes an independent data controller for that processing activity and bears direct compliance obligations and liability. The NDPC holds both controllers and processors accountable for their respective obligations under the NDPA.
Cross-border transfer of personal data outside Nigeria is restricted under Section 43 of the Nigeria Data Protection Act 2023 (NDPA) and requires appropriate safeguards. A Data Processing Agreement must address cross-border transfers where a Nigerian data controller engages a data processor established outside Nigeria (such as a cloud service provider located in the US, EU, or elsewhere). Under NDPA Section 43, personal data may be transferred outside Nigeria only where: (1) the receiving country has been assessed as providing adequate data protection by the NDPC; (2) the controller has implemented appropriate safeguards, such as standard data protection clauses approved by the NDPC or binding corporate rules; or (3) a specific derogation applies (such as explicit consent of the data subject or necessity for performance of a contract with the data subject). The NDPC is expected to publish an adequacy list identifying countries deemed to provide adequate protection; pending this, organisations should implement appropriate safeguards — in practice, Standard Contractual Clauses adapted from the EU's approved SCCs or the UK's International Data Transfer Addendum. Where a DPA involves cross-border processing, the agreement should include a specific transfer mechanism, identify the safeguards in place, and record the data controller's assessment of the adequacy of protection in the receiving country. Transfers made without a valid transfer mechanism violate NDPA Section 43 and may result in NDPC enforcement action.
When a data processor suffers a personal data breach involving the data controller's personal data, a time-critical response process is triggered for both the processor and the controller. Under the NDPA 2023, the data processor must notify the data controller without undue delay upon becoming aware of the breach — the DPA should specify this as a maximum 24-hour notification to the controller, to allow the controller to meet its own regulatory obligation. The data controller must then notify the Nigeria Data Protection Commission (NDPC) within 72 hours of becoming aware of the breach under NDPA Section 40, providing: a description of the nature of the breach; the categories and approximate number of data subjects affected; the categories and approximate number of personal data records affected; the contact details of the DPO or responsible person; likely consequences of the breach; and the measures taken or proposed to address the breach and mitigate its effects. Where the breach is likely to result in high risk to data subjects, the controller must also notify affected data subjects directly under NDPA Section 40(3). The data controller should assess whether the processor's DPA obligations were met — including security measures, incident detection, and notification procedures. Where processor non-compliance contributed to the breach, the controller may have contractual claims against the processor under the DPA indemnification provisions, and the NDPC may hold the processor directly liable for its NDPA obligations.
A Data Processing Agreement (Nigeria) does not legally require a lawyer in Nigeria, though legal advice is recommended. Under Nigerian law, the Companies and Allied Matters Act 2020 (CAMA) governs corporate documents through the Corporate Affairs Commission (CAC). The National Industrial Court of Nigeria (NICN) adjudicates employment disputes. The Nigeria Data Protection Regulation (NDPR) and NDPC impose data protection obligations. The Federal Inland Revenue Service (FIRS) requires tax compliance. Forms-legal.com provides this template as a starting point — always review with a qualified Nigerian lawyer for significant transactions. Under Nigeria law, Companies and Allied Matters Act (CAMA) 2020, parties should seek independent legal advice from a qualified lawyer to confirm compliance with all applicable requirements. Under Nigerian law, the Companies and Allied Matters Act 2020 (CAMA) regulates corporate entities through the Corporate Affairs Commission (CAC). The Labour Act (Cap L1 LFN 2004) and the National Industrial Court of Nigeria (NICN) govern employment disputes. Forms-legal.com provides this template as a starting point for Nigeria-compliant documentation.
This template is provided for informational purposes only and does not constitute legal advice. Laws vary by jurisdiction and change over time. Consult a qualified attorney for advice specific to your situation.Full disclaimer
Found an error? Let us knowRelated Documents
You may also find these documents useful:
Data Consent Form (Nigeria)
A Nigeria-compliant data consent form for collecting freely given, specific, informed, and unambiguous consent for processing personal data under the Nigeria Data Protection Act (NDPA) 2023. Covers purpose specification, data subject rights, withdrawal of consent, and sensitive personal data categories.
Data Privacy Impact Assessment (Nigeria)
A Data Privacy Impact Assessment (DPIA) template for Nigerian organisations compliant with the Nigeria Data Protection Act (NDPA) 2023 and NDPC guidance. Covers risk identification, mitigation measures, consultation obligations, and documentation requirements for high-risk data processing activities.
Cybersecurity Policy (Nigeria)
A corporate cybersecurity policy for Nigerian organisations compliant with the Cybercrimes (Prohibition, Prevention, Etc.) Act 2015, CBN Cybersecurity Framework 2021, NDPC Nigeria Data Protection Act 2023, and the NCC Cybersecurity Regulations. Covers access controls, incident response, data protection, and staff obligations.