Nigeria: NDPA 2023

The framework

Our processing is governed by the Nigeria Data Protection Act 2023 (NDPA) and its subsidiary instruments, including the Nigeria Data Protection Commission’s General Application and Implementation Directive (GAID) 2025.

Lawful bases

The NDPA recognises consent, contract, legal obligation, vital interest, public interest and legitimate interest as lawful bases (NDPA s. 25). We state the basis for each collection on the collection pages: forms rest on contract (steps at your request prior to one), except Cueprise™ demo requests, Storefront™ enquiries and Cuelearn™ demo requests, which rest on legitimate interest because the agreement that may follow is with your organisation rather than with you; infrastructure, Ace and the websites’ and documentation sites’ performance and error monitoring on legitimate interest, and website analytics and advertising tags on consent, which you can withdraw as easily as you gave it.

Your rights under the NDPA

You hold the rights of a data subject under Part VI of the NDPA, including: to be informed (this policy); access; correction; deletion; restriction; objection; data portability; to withdraw consent; and not to be subject to solely automated decisions with legal or similar effect, which we do not make. Exercise any of them through hello@cuesoft.io as described on the rights page.

Complaints

You may lodge a complaint with the Nigeria Data Protection Commission: ndpc.gov.ng. We would appreciate the chance to resolve your concern first, but you do not need our permission: the right is yours.

Breach notification

Where a qualifying breach occurs, we notify the NDPC within 72 hours of becoming aware, and notify you without undue delay where the breach is likely to put your rights and freedoms at risk: see breach notification.

Transfers out of Nigeria

Cross-border transfers follow the NDPA’s adequacy and safeguard provisions and the NDPC’s implementing instruments: see international transfers.

Registration status

The NDPC designates a data controller of major importance on any one of three independent grounds: processing the personal data of more than 200 data subjects in six months; carrying out commercial ICT services on a device that holds another person’s data; or processing personal data as an organisation or service provider in one of thirteen named sectors. Those sectors include education, and the Commission’s own classification of designated entities names corporate training service providers.

Whether Cuesoft is designated on any of those grounds is under review. This page will state the outcome, and where designation applies it will name our registration and our designated data protection officer. Questions in the meantime: hello@cuesoft.io.