Nigeria's data law exempts journalism. It does not exempt your newsletter.

The Nigeria Data Protection Act was signed on 12 June 2023 and commenced on signature. It is the first full statute for personal data in the country, replacing a 2019 regulation that most publishers ignored. Three parts of it matter to anyone who publishes news to Nigerians, wherever they sit.

1. The journalism exemption is real, and narrow

Section 3 lists processing the Act does not fully apply to. One of the items is processing “in respect of publication in the public interest, for journalism, educational, artistic and literary purposes to the extent that such obligations and rights are incompatible with such purposes”.

Read the last clause twice. The exemption is not “journalists are exempt”. It is: a newsroom’s obligations under the Act fall away only to the extent they are incompatible with publishing in the public interest. Holding a source’s name without their consent, keeping a leaked document, processing a politician’s financial details for a story: those are the things the clause protects.

Even inside the exemption, the Act still binds exempt processing to its core principles. The Future of Privacy Forum’s reading of the text is that exempt controllers must still comply with section 24 (the processing principles, including a duty of care), section 25 (lawful basis), section 32 (a data protection officer, for controllers of major importance) and section 40 (breach notification). A newsroom that loses a source database still has to notify.

2. The mailing list is not journalism

A reader who subscribes to a newsletter is not a source and not a subject. Their email address is collected for marketing and distribution. Nothing about storing it is “incompatible” with publishing in the public interest, so nothing about it is exempt.

The same goes for website analytics, membership billing, WhatsApp channel admin data, and any CRM. These are ordinary processing under the Act: a lawful basis (section 25, usually consent), a privacy notice, the data subject’s rights to access and erasure, and breach notification to the Commission within 72 hours of becoming aware.

The practical consequence is structural, not legal: keep the subscriber database and the editorial database apart. The one that holds sources can lean on the exemption. The one that holds readers cannot, and should never be able to see the other.

3. Distance does not help

Section 2 applies the Act to processing of the personal data of data subjects in Nigeria by controllers not established in Nigeria. The Future of Privacy Forum notes this is broader than Europe’s rule, which requires the foreign controller to be “targeting” the market. Nigeria’s text has no targeting test: if the readers are in Nigeria, the Act reaches the publisher.

So a publisher in Lisbon, London or Praia with a Nigerian mailing list is a controller under this Act, with the same obligations as one in Ikeja.

What it costs to get wrong

The penalty tiers, per the Future of Privacy Forum’s summary of the Act: for a “data controller or processor of major importance”, the higher of ₦10,000,000 or 2% of the previous year’s gross revenue; for everyone else, the higher of ₦2,000,000 or 2%. A data subject also has a private right of action for damages.

For a small publisher the fine is not the main risk. The main risk is that a complaint about a mailing list becomes the lever for a regulator, or a litigant, to reach into records the exemption was supposed to protect. Separation is the defence.

Kairos Reports and this Act

This site’s subscriber list lives with a newsletter provider and nowhere else. The editorial system that holds sources and documents has no access to it, by design. Our full position is on the subscribe page.