← NDPA 2023 · Transfers

s.41-43 — Cross-border transfer of personal data

critical cross-border-transfervendor-management

Requirement

Personal data may be transferred out of Nigeria only where the recipient is subject to a law, binding corporate rules, contractual clauses, a code of conduct or a certification mechanism affording an adequate level of protection (s.41–42), or where a section 43 basis such as consent or contractual necessity applies; the controller shall record the basis relied upon and the adequacy assessment.

What the engine looks for

Every group below must be satisfied — by an affirmative statement, not a plan, a hedge or a denial — for the control to count as covered. A term ending in … matches any word it begins. Supporting terms do not change the verdict — they raise confidence and distinguish a policy that names a mechanism from one that gestures at a category.

Required element 1 — any one of

transfercross-borderoutside nigeriainternational transferthird country

Required element 2 — any one of

adequateadequacycontractual clausebinding corporate rulescertificationcode of conductderogation

Supporting terms — specificity signals

section 41ndpcrecordedassessmentdata residencysub-processor locationconsent to transfersection 42section 43

Contradiction markers

Finding any of these outranks coverage — a policy that admits the gap is worse than silence.

no transfer mechanism transfers are not assessed

Equivalent controls elsewhere

Matched on shared topics. Satisfying this control usually moves these too.

Framework	Control	Title	Shared topics
GDPR	Art.44-49	Transfers of personal data to third countries	cross-border-transfer vendor-management
GDPR	Art.26	Joint controllers	vendor-management
GDPR	Art.27	EU representative for non-EU organisations	cross-border-transfer
GDPR	Art.28	Processors and processing agreements	vendor-management
CCPA/CPRA	1798.100(d)	Contracts with service providers, contractors and third parties	vendor-management
SOC 2	CC2.3	External communication	vendor-management
SOC 2	CC9.2	Vendor and business partner risk management	vendor-management
ISO 27001	A.5.19	Information security in supplier relationships	vendor-management