Nigeria Data Protection Act (NDPA)

Personal data processed by Huawei Cloud mainly includes customers' content data and personal data provided by customers when performing operations on Huawei Cloud platform, including but not limited to registering, purchasing services, real-name authentication and service support. As customers have full control over their content data, when customers decide to use Huawei Cloud services or applications to processing personal data included in content data, Huawei Cloud is generally regarded as the data processor. Huawei Cloud acts as the data controller when Huawei Cloud collects personal data from customer for the customers' set up or management of their Huawei Cloud account.

Based on the characteristics of Huawei Cloud's business and the requirements of Nigeria NDPA, Huawei Cloud, as a legal entity that processes personal data, assumes two different roles including data controller and data processor in different scenarios and actively responds to and fulfills its obligations. Huawei Cloud has conducted in-depth analyses on the obligations of different roles and listed the specific requirements of each applicable obligation and the corresponding measures. For more details, see HUAWEI CLOUD Nigeria Privacy Compliance Instruction.

As a customer of cloud products and services, you have the right to decide on how to use these products and services and how to use them to store and process content data, including personal data. Therefore, you are responsible for the security and compliance of the content data. To be brief, you are responsible for content security. Your responsibilities are as follows:

● Content data protection: You must correctly and completely identify personal data on the cloud, develop policies to protect personal data security and privacy, and take appropriate privacy protection measures. Specific measures include security configuration based on service and privacy protection requirements, such as operating system configuration, network configuration, security protection, and database encryption policies, and proper access control policies and password policies.

● Response to data subjects' rights: You must protect the rights of data subjects and respond to data subjects' requests. When a personal data breach occurs, you must take appropriate actions in compliance with laws and regulations, such as notifying regulatory authorities, notifying data subjects, and taking mitigation measures.

When you are an entity responsible for processing personal data and Huawei Cloud assists with the processing of personal data in your content data, you may fall into the jurisdiction of the Nigeria NDPA. If you are in this jurisdiction, you must comply with the Nigeria NDPA privacy protection principles. Based on the data protection principles stipulated in this law, Huawei Cloud lists your privacy protection responsibilities as an entity responsible for processing personal data and the service support that Huawei Cloud can provide.

In addition, Huawei Cloud provides you with a wide range of cloud products or services that can help you meet the compliance requirements of the Nigeria NDPA. The products and services include network products, database products, security products, and management and deployment tools. They provide functions such as data protection, data deletion, network isolation, and permission management to help you protect content data privacy.

For more details, see HUAWEI CLOUD Nigeria Privacy Compliance Instruction.