Nigeria Data Protection Act, 2023 — personal data of children and persons lacking legal capacity

s. 31 requires the consent of a parent or legal guardian where the data subject is a child or otherwise lacks legal capacity to consent, and a child is anyone under 18, tracking the Child's Rights Act rather than any lower digital-consent age. Two details matter operationally. s. 31(5) provides that a child under 13 cannot give consent at all, so the under-13 and 13-to-17 groups are not treated identically even though both need a parent. And the Act does not leave age assurance to best efforts: a controller must apply appropriate mechanisms to verify age and consent taking available technology into account, with presentation of a government-approved identification document expressly named as an appropriate mechanism. Parental consent is not required where processing is necessary to protect the child's vital interests, is carried out for education, medical or social care by a professional owing a duty of confidentiality, or is necessary for court proceedings relating to the individual.