This policy is built around the following Nigerian legal instruments and, in a few places, internationally recognized good practice that the Academy has chosen to follow even where it is not strictly mandated. Because the Academy's giving base includes diaspora donors and its hosting infrastructure may sit outside Nigeria, we have written this policy to the standard expected under Nigeria's own law rather than to the minimum. Statutory citations below reflect the Act's publicly reported structure as of this drafting; the Academy should have counsel verify exact section numbers against the Act's official gazetted text before external publication.
4.1 Nigeria Data Protection Act 2023 (NDPA)
The NDPA is the primary law governing this policy. It establishes the Nigeria Data Protection Commission (NDPC) as regulator, sets out the lawful bases on which personal data may be processed, grants data subjects a defined set of rights, imposes obligations on data controllers and processors (including breach notification, security, and — for controllers "of major importance" — mandatory appointment of a Data Protection Officer), restricts cross-border data transfers, and creates a tiered penalty regime. The NDPA superseded the Nigeria Data Protection Regulation (NDPR) 2019, which had been issued by NITDA under a narrower statutory basis. Every substantive obligation described in Sections 5 through 19 of this policy traces back to the NDPA.
4.2 NDPC General Application and Implementation Directive (GAID) 2025
The NDPC's General Application and Implementation Directive, issued in 2025, is subsidiary guidance that operationalizes the NDPA — including thresholds for who must file annual Compliance Audit Returns through a licensed Data Protection Compliance Organisation (DPCO), and more detailed expectations around registration, breach handling, and cross-border transfer documentation. Where this policy references specific thresholds (see Section 6.2), they are drawn from the GAID as currently understood, and should be reconfirmed against the NDPC's published version before the Academy relies on them for a compliance filing.
4.3 Constitution of the Federal Republic of Nigeria 1999 (as amended)
Section 37 of the Constitution guarantees Nigerian citizens the right to privacy of their homes, correspondence, telephone conversations, and telegraphic communications. The NDPA gives that constitutional right concrete, enforceable form in the context of personal data, and this policy is one part of the Academy's compliance with both.
4.4 Child Rights Act 2003
The Child Rights Act defines a child as a person under the age of 18 and establishes the "best interests of the child" as the paramount consideration in any action concerning a child. Because the Academy's beneficiaries are youths and some may be minors, this principle governs how we seek consent, use images or stories, and decide what is and is not shown publicly about any beneficiary who is a child (see Section 16).
4.5 Companies and Allied Matters Act 2020 (CAMA), Part F — Incorporated Trustees
Nigerian NGOs typically operate as an Incorporated Trustee registered with the Corporate Affairs Commission (CAC) under Part F of CAMA 2020. [Insert Eifen & Eighth Academy's CAC/RC registration number and registered name once available.] CAMA governs the Academy's governance obligations — including annual returns and audited financial statements — which is part of why donor-facing financial traceability (see the Foundation Operations Platform's fund model) and this privacy policy exist side by side: honest financial reporting and honest data protection are both legitimacy signals for a young nonprofit.
4.6 Money Laundering (Prevention and Prohibition) Act 2022 and SCUML
Nigerian NGOs are classified as Designated Non-Financial Institutions (DNFIs) under Nigeria's anti-money-laundering framework and are required to register with the Special Control Unit Against Money Laundering (SCUML), which operates under the Economic and Financial Crimes Commission (EFCC), and to file periodic reports on funding sources and large or suspicious transactions. This is the legal basis on which donor and donation records (name, amount, date, bank/transfer reference) may, where required, be disclosed to SCUML or other competent authorities — see Section 11.4.
4.7 Freedom of Information Act 2011 and sector transparency norms
While the Freedom of Information Act applies most directly to public institutions, the transparency norms it reflects — and that serious donors and grant-makers increasingly expect of NGOs — inform the Academy's approach to aggregate, non-identifying donor reporting (impact figures, fund balances, spend-per-cohort). This policy's consent gates (Section 9) exist precisely so that transparency can be pursued without compromising the Act's privacy protections.
4.8 International frameworks followed as good practice
The Academy is not directly subject to the EU/UK General Data Protection Regulation (GDPR) or U.S. state privacy laws such as the California Consumer Privacy Act (CCPA), but voluntarily aligns with their core principles — purpose limitation, data minimization, a defined set of data subject rights, and breach notification — for two reasons: it is good practice regardless of jurisdiction, and it builds trust with diaspora donors based in the US, UK, and EU who may reasonably expect protections consistent with the laws of the countries they give from. Where a future feature (e.g., a payment processor, or an email platform) is itself subject to GDPR or similar law as a matter of where it operates, the Academy will follow that processor's own compliance requirements as part of its due diligence (Section 20).