{"ruleset":"NG-1 v1.1.0","rules":[{"id":"CBN-001","title":"Payment transaction data must be stored AND managed in Nigeria","source_ref":"CBN circular PSS/DIR/PUB/CIR/001/004 (15 June 2026)","effective_date":"2027-01-01"},{"id":"CBN-002","title":"Split-cloud architectures create cross-border dependencies in scope","source_ref":"Hyperscaler guidance reported Oct 2026 (Aree Tech; BusinessDay)","effective_date":"2027-01-01"},{"id":"NDPA-41","title":"Cross-border transfer requires adequate protection","source_ref":"Nigeria Data Protection Act 2023, ss 41–42","effective_date":"2023-06-14"},{"id":"NDPA-41A","title":"Adequacy assessment must be conducted and the NDPC notified before transfer","source_ref":"Nigeria Data Protection Act 2023, s 41(2)-(3); NDPC GAID 2025, art 45 + Schedule 5","effective_date":"2025-09-19"},{"id":"NDPA-41B","title":"Transfer instruments require NDPC approval before adoption","source_ref":"Nigeria Data Protection Act 2023, s 41(3); NDPC GAID 2025, Schedule 5(b)","effective_date":"2025-09-19"},{"id":"NDPA-43A","title":"Section 43 derogations are narrow and must be justified on the record","source_ref":"Nigeria Data Protection Act 2023, s 43; NDPC GAID 2025, Schedule 5 para 6","effective_date":"2025-09-19"},{"id":"NDPA-W1","title":"Worker data shared abroad must be minimised to the verification need","source_ref":"Nigeria Data Protection Act 2023, ss 41-43 + GAID 2025 Schedule 5 (applied to workforce records)","effective_date":"2025-09-19"},{"id":"NDPA-43","title":"Without adequacy, transfer needs a s43 basis","source_ref":"Nigeria Data Protection Act 2023, s 43","effective_date":"2023-06-14"}]}