Section 38, NDPA

Data portability

(1) The Commission may make regulations establishing a right of personal data portability.

(2) Right of data portability under this Act shall entitle the data subject to —

(a) receive, without undue delay from a data controller, personal data concerning the data subject in a structured, commonly used, and machine-readable format;

(b) transmit the personal data obtained under paragraph (a) to another data controller without any hindrance; and

(c) where technically possible, have the personal data transmitted directly from one data controller to another.

(3) The Commission may prescribe —

(a)circumstances and conditions on which the data subject may exercise the right of data portability; and

(b) the obligations it would impose on a data controller or data processor, or categories of data controllers or data processors, including in relation to costs and timing.

---

This is Section 38 of the Nigeria Data Protection Act 2023. To explore the rest of the legislation, please use the links below:

• See the Full Act (Index)
• Read Section 39: Security, integrity and confidentiality
• Back to Section 37: Automated decision making