The NDPA restricts sending personal data outside Nigeria: a transfer is only permitted where the recipient country, organization, or contractual arrangement offers a level of protection adequate to or consistent with the Act — demonstrated through an applicable law, binding corporate rules, standard contractual clauses, an approved code of conduct, or a certification mechanism — and, in some cases, where the data subject has separately consented to that specific transfer.
Two situations bring this into play for the Academy:
- Hosting infrastructure. The Foundation Operations Platform and, once launched, the public website and donor portal, may be hosted on infrastructure located outside Nigeria depending on the hosting provider and region selected. Where that is the case, the Academy selects providers with recognized security and privacy commitments and documents the basis for the transfer, consistent with the Act's requirements.
- Diaspora donors. Donors giving from the United States, United Kingdom, European Union, or elsewhere provide personal data (name, contact email, giving details) from outside Nigeria, which the Academy then processes inside Nigeria. This is a transfer into Nigeria, not out of it, and is handled under the same principles set out in this policy plus, where relevant, the data protection law of the donor's own country.
We do not transfer beneficiary data outside Nigeria for any purpose other than the hosting arrangement described above, and never in a form that identifies an individual beneficiary without the consent described in Section 9.