Nigeria Data Protection Act, 2023 — cross-border transfer of personal data

s. 41(1) restricts transfer out of Nigeria by default and then supplies the ways through: the recipient must be subject to a law, binding corporate rules, contractual clauses, a code of conduct, or a certification mechanism that affords an adequate level of protection consistent with the Act. The Nigeria Data Protection Commission may issue adequacy decisions covering a country, a sector within a country, or a region, and may approve standard contractual clauses and cross-border data transfer instruments. Marked 'check': the operative detail now sits substantially in the GAID 2025 rather than the Act, and the Commission's adequacy and instrument-approval practice is still developing — a business should confirm which route the NDPC currently recognises rather than assuming the statutory list is self-executing.