Ask most organisations about cross-border data transfers, and the first question is whether the data is leaving the country. That is a fair starting point, but it is not the question that decides compliance. The better one is: what is the relationship between the organisations involved, and which transfer mechanism fits that relationship?
For Nigerian and African organisations, that question is becoming harder to avoid. Cloud hosting, offshore support teams, regional headquarters, fintech partnerships, and SaaS vendors mean personal data crosses borders daily, often without anyone deciding it should.
The legal backdrop
Under the Nigeria Data Protection Act (NDPA) 2023, transfers of personal data outside Nigeria are regulated in Part VIII. In broad terms, a controller or processor may transfer data abroad where the recipient is subject to a law, binding corporate rules, contractual clauses, a code of conduct or a certification mechanism that provides an adequate level of protection. The Act also allows reliance on adequacy findings and on limited derogations in specific circumstances. The NDPC’s General Application and Implementation Directive (GAID) adds operational detail.
Other African frameworks follow a similar logic. South Africa’s POPIA restricts transfers to third parties in foreign countries unless defined conditions are met, and expressly recognises binding corporate rules among them. Kenya’s Data Protection Act requires proof of appropriate safeguards before data leaves the country. Ghana and a growing number of other jurisdictions take comparable positions.
The common thread is that an organisation must show it has chosen a mechanism that fits the transfer and actually protects the data.
Binding Corporate Rules: One group, One framework
Binding Corporate Rules (BCRs) are an internal, group-wide set of data protection rules. They suit multinational corporate groups that regularly move personal data between their own entities across jurisdictions.
Picture a pan-African banking group with subsidiaries in Nigeria, Ghana, Kenya and South Africa, plus a parent company in Europe. Instead of negotiating a separate agreement for every flow between every entity, the group adopts one privacy framework that binds all of them. Data moves within the group under a consistent standard.
The strengths of BCRs are consistency and scale. The trade-offs are cost, time and effort. BCRs typically require substantial governance work, internal enforceability and, in many regimes, regulatory review or approval. That investment makes sense for a mature group with heavy, ongoing intra-group transfers. It makes little sense for a company that simply uses an overseas payroll provider.
Standard Contractual Clauses: different organisations, contractual safeguards
Standard Contractual Clauses (SCCs) work differently. They are pre-drafted contractual terms that bind the exporting and importing parties to specific data protection obligations. They are generally the more practical tool where data goes to an external organisation, such as a cloud provider, an analytics vendor or an offshore outsourcing partner, that is not part of your corporate group.
Think of a Lagos e-commerce company engaging a customer support vendor abroad. The two entities have no shared governance, so a contract with defined safeguards is the natural way to bind the recipient to appropriate handling of the data.
One point deserves attention in our region. The best-known SCCs are the European Commission’s, built around the GDPR. Nigeria and many other African jurisdictions do not yet have a single, universally recognised template of their own. Organisations therefore often adapt EU-style clauses or draft bespoke terms. Whatever the source, the clauses must be aligned with the applicable local law. Dropping a foreign template into a contract and calling it done is not enough.
The trap: “We signed, so we’re compliant”
This is where many organisations go wrong. They treat the transfer mechanism as a paperwork exercise and ask: “Do we have an agreement?”
The better question is: “Does this mechanism actually provide adequate protection and comply with the applicable law?“
Signing SCCs does not automatically make a transfer lawful. A responsible assessment looks at:
- the transfer rules that apply in the exporting jurisdiction;
- the legal environment in the destination country, including government access to data;
- the nature and sensitivity of the data;
- the parties involved and their roles;
- whether supplementary safeguards, such as encryption, pseudonymisation or access controls, are needed.
This reflects the thinking that followed the Schrems II decision in Europe, where contractual tools were found to be insufficient on their own if the destination country’s laws undermined the protections promised. The principle travels well: a contract cannot override a legal environment that makes its promises impossible to keep.
Not rivals, not substitutes
It is tempting to rank these tools. BCRs are not simply “better SCCs”, and SCCs are not simply “cheaper BCRs”. They answer different structural questions. BCRs fit a group with ongoing internal flows. SCCs fit a relationship between separate organisations. Other mechanisms, such as adequacy decisions, codes of conduct, certification or narrow statutory derogations, may suit particular situations better than either.
A practical approach for DPOs
- Map your transfers. You cannot choose a mechanism for flows you have not identified.
- Classify the relationship. Intra-group, controller to processor, or controller to controller?
- Identify the governing law, both at origin and at destination.
- Select the mechanism that fits the structure, not the one that is easiest to sign.
- Assess the destination environment and document the reasoning.
- Add safeguards where needed, and review as laws and vendors change.
The real skill in cross-border compliance is matching the mechanism to the transfer in front of you. Documentation alone does not protect data. Judgement does.
