Digital Health Data Governance for AI in Africa: Consent, Secondary Use, Cross-Border Transfer and the Nigeria Data Protection Act 2023 in Health Research
DOI:
https://doi.org/10.68854/tswyxn11Keywords:
health data governance, artificial intelligence, consent, secondary use, cross-border data transfer, Nigeria Data Protection Act 2023, research ethics, data sovereigntyAbstract
Artificial intelligence (AI) in African health care depends on health data that are collected under research ethics regimes designed for single studies, reused for purposes those regimes did not anticipate, and often processed on systems outside the continent. The Nigeria Data Protection Act 2023 (NDPA) now governs this activity, yet no peer-reviewed study identified in the literature analyses how the Act applies to health research that uses AI. This theoretical and conceptual study sets out the lawful and ethical conditions under which health data may be used to train, evaluate, run and monitor AI systems in Nigerian health research. It combines an integrative review of 76 peer-reviewed journal articles published between 2023 and 2026, drawn from 80 records identified through ScienceDirect, MEDLINE and supplementary Crossref searches and verified against Crossref, with provision-by-provision doctrinal analysis of the NDPA and the Nigeria Data Protection Commission’s General Application and Implementation Directive, and with normative framework development informed by Ubuntu, decolonial and trust-based theory. The analysis finds that the NDPA applies to foreign developers processing Nigerian data, contains no research exemption, and requires both a lawful basis and a sensitive-data ground for every use. Its consent standard sits uneasily with broad consent for future model training, while its research, public health and medical-care grounds lack AI-specific guidance; the status of pseudonymised research data is untested; and transfers abroad are prohibited unless adequacy or a narrow statutory condition applies. A four-use typology shows that training, evaluation, inference and monitoring each raise distinct consent and transfer questions that a single consent form or ethics approval cannot answer. The paper proposes a five-pillar governance framework covering use-specific legal mapping, layered and dynamic consent, a secondary-use gateway, transfer control and data sovereignty, and accountability, capacity and benefit-sharing. It recommends sector guidance from the Commission, adequacy assessments and approved transfer instruments, updated ethics guidance and committee training, institutional data access committees and data transfer agreements, and funding conditions that secure local data custodianship.
References
Abdullateef, R. O., Olawuyi, D. A., Usin, S. G., Olajire, G. A., Opatola, A. D., Agboola, R. A., & Ibrahim, G. (2026). Advancing genomic medicine in Nigeria: Research progress, clinical translation and policy priorities. Journal of Community Genetics, 17(5), Article 117. https://doi.org/10.1007/s12687-026-00955-y
Adebamowo, C., Akintola, A., Maduka, O. C., Ikhane, P., Jegede, A., Callier, S., Akintola, S., Ogundiran, T., Adeyemo, O., Adebamowo, S. N., & BridgELSI Project as part of the DS-I Africa Consortium. (2025). Knowledge and recommendations of stakeholders regarding ethical oversight of data science health research: Protocol for a qualitative study. JMIR Research Protocols, 14, Article e78557. https://doi.org/10.2196/78557
Adegoke-Elijah, A., Macauley, O., Jimoh, K. O., Zevallos-Aquije, A., Olopade, O. I., & Aribisala, B. (2026). A framework for a national cancer imaging repository in Nigeria. Scientific Reports, 16(1), Article 15945. https://doi.org/10.1038/s41598-026-44098-z
Adeyeye, A. O. (2024). Public attitudes towards surveillance and privacy of personal communications in 34 African countries. Telematics and Informatics, 91, Article 102147. https://doi.org/10.1016/j.tele.2024.102147
Akintola, A., Ikhane, P., Maduka, O. C., Akintola, S., Ogundiran, T., Jegede, A., Adeyemo, O., Callier, S., Adebamowo, S. N., & Adebamowo, C. A. (2025). Protocol for a modified Delphi study of ethical oversight of data science health research (DSHR). BMJ Open, 15(12), Article e105799. https://doi.org/10.1136/bmjopen-2025-105799
Alaran, M. A., Lawal, S. K., Jiya, M. H., Egya, S. A., Ahmed, M. M., Abdulsalam, A., Haruna, U. A., Musa, M. K., & Lucero-Prisno, D. E. (2025). Challenges and opportunities of artificial intelligence in African health space. Digital Health, 11, Article 20552076241305915. https://doi.org/10.1177/20552076241305915
Aloamaka, P. C. A. (2023). Data protection and privacy challenges in Nigeria: Lessons from other jurisdictions. UCC Law Journal, 3(1), 281–321. https://doi.org/10.47963/ucclj.v3i1.1259
Aloamaka, P. C. A. (2025). A critical analysis of the Nigeria Data Protection Act 2023: Elevating standards to global norms. UCC Law Journal, 4(2), 242–263. https://doi.org/10.47963/ucclj.v4i2.1724
Amoakoh-Coleman, M., Vieira, D., & Abugri, J. (2023). Ethical considerations for biobanking and use of genomics data in Africa: A narrative review. BMC Medical Ethics, 24(1), Article 108. https://doi.org/10.1186/s12910-023-00985-y
Atariata, O., Asangansi, I., Adoghe, A., Alle, O., & Abdulsalam, U. (2026). Consolidation of health data to improve health data governance using the Multi-Source Data Analytics and Triangulation platform. BMJ Health & Care Informatics, 33(1), Article e101837. https://doi.org/10.1136/bmjhci-2025-101837
Ayana, G., Dese, K., Daba Nemomssa, H., Habtamu, B., Mellado, B., Badu, K., Yamba, E. I., Faye, S. L., Ondua, M., Nsagha, D. S., Nkweteyim, D. L., & Kong, J. D. (2024). Decolonizing global AI governance: Assessment of the state of decolonized AI governance in sub-Saharan Africa. Royal Society Open Science, 11(8), Article 231994. https://doi.org/10.1098/rsos.231994
Bekele, R., Moen, A., Belina, M., Saranto, K., & Berhane, K. (2026). Determinants of collaboration dynamics and challenges in North-South data-driven health research in the African context: An epistemic injustice perspective. Frontiers in Research Metrics and Analytics, 11, Article 1885894. https://doi.org/10.3389/frma.2026.1885894
Botes, M. (2025). Regulatory challenges of digital health: The case of mental health applications and personal data in South Africa. Frontiers in Pharmacology, 16, Article 1498600. https://doi.org/10.3389/fphar.2025.1498600
Bronstein, V., & Nyachowe, D. T. (2023). Streamlining regulatory processes for health researchers: To what extent does POPIA apply? South African Medical Journal, 113(8), 30–33. https://doi.org/10.7196/SAMJ.2023.v113i8.781
Brown, Q., Chabilall, J., Cengiz, N., & Moodley, K. (2024). Trust as moral currency: Perspectives of health researchers in sub-Saharan Africa on strategies to promote equitable data sharing. PLOS Digital Health, 3(9), Article e0000551. https://doi.org/10.1371/journal.pdig.0000551
Cengiz, N., Kabanda, S. M., & Moodley, K. (2024). Cross-border data sharing through the lens of research ethics committee members in sub-Saharan Africa. PLOS ONE, 19(5), Article e0303828. https://doi.org/10.1371/journal.pone.0303828
Edgcumbe, A., Botes, M., Donnelly, D. L., Townsend, B., Shachar, C., & Thaldar, D. (2025). ‘Potato potahto’? Disentangling de-identification, anonymisation, and pseudonymisation for health research in Africa. Journal of Law and the Biosciences, 12(1), Article lsae029. https://doi.org/10.1093/jlb/lsae029
Edgcumbe, A., Strydom, A., Thaldar, D. W., & Pepper, M. S. (2026). Exploring the challenges and legal implications of secondary use of health data in South Africa. Developing World Bioethics. Advance online publication. https://doi.org/10.1111/dewb.70047
Ekusai-Sebatta, D., Kyaddondo, D., Kaawa-Mafigiri, D., Barugahare, J., Ssentongo, J. S., Singh, S., & Mwaka, E. (2025). “It just feels morally not right to sell the data”: Ethical and social perspectives on human genomic data sharing in Uganda—A phenomenological qualitative study. Research Ethics, 22(2), 252–271. https://doi.org/10.1177/17470161251361575
Esselaar, P., Swales, L., Bellengère, D., Mhlongo, B., & Thaldar, D. (2024). Forcing a square into a circle: Why South Africa’s draft revised material transfer agreement is not fit for purpose. Frontiers in Pharmacology, 15, Article 1333672. https://doi.org/10.3389/fphar.2024.1333672
Evertsz, N., Bull, S., & Pratt, B. (2023). What constitutes equitable data sharing in global health research? A scoping review of the literature on low-income and middle-income country stakeholders’ perspectives. BMJ Global Health, 8(3), Article e010157. https://doi.org/10.1136/bmjgh-2022-
Gooden, A., & Thaldar, D. (2024). The proposed Code of Conduct for Research in South Africa: Despite good progress, unresolved issues remain. Humanities and Social Sciences Communications, 11(1), Article 251. https://doi.org/10.1057/s41599-024-02715-0
Jaiyebo, O., & Eruteya, U. (2026). An analysis of the scope and boundaries of personal data under the Nigeria Data Protection Act. Abuja Journal of Public Law, 5(1), 1–24. https://doi.org/10.70118/abjpl.202605010.26
Joy Mgbeokwere, C., & Ini-Obong Monday, M. (2026). Appraisal of the algorithmic governance gap under the Nigeria Data Protection Act, 2023 in the era of AI-driven decision-making. Abuja Journal of Public Law, 5(1). https://doi.org/10.70118/abjpl.202605010.08
Kabanda, S. M., Cengiz, N., Rajaratnam, K., Watson, B. W., Brown, Q., Esterhuizen, T. M., & Moodley, K. (2023). Data sharing and data governance in sub-Saharan Africa: Perspectives from researchers and scientists engaged in data-intensive research. South African Journal of Science, 119(5/6). https://doi.org/10.17159/sajs.2023/15129
Kakraba, S., Agyemang, E. F., & Srivastav, S. K. (2026). Cognitive sovereignty and decolonial public health: Reclaiming epistemic authority in the global AI era. Frontiers in Public Health, 14, Article 1785170. https://doi.org/10.3389/fpubh.2026.1785170
Kayondo, B. N., & Kyobe, M. (2025). Influence of trust on hospital staff compliance with the data protection act, moderated by noncompliance costs – a Ugandan case study. Information & Computer Security, 33(4), 649–669. https://doi.org/10.1108/ics-08-2024-0210
Kiwuwa-Muyingo, S., Todd, J., Bhattacharjee, T., Taylor, A., & Greenfield, J. (2023). Enabling data sharing and utilization for African population health data using OHDSI tools with an OMOP-common data model. Frontiers in Public Health, 11, Article 1116682. https://doi.org/10.3389/fpubh.2023.1116682
Li, Y., Bowen, D. J., & Yu, J. H. (2025). Informed consent in genetic and genomic studies in sub-Saharan Africa: A systematic review of bioethical issues. BMC Medical Ethics, 26(1), Article 99. https://doi.org/10.1186/s12910-025-01170-z
Maseme, M., Gardner, J., & Mahomed, S. (2023). Broad consent for biobank research in South Africa – Towards an enabling ethico-legal framework. Global Bioethics, 35(1), Article 2288331. https://doi.org/10.1080/11287462.2023.2288331
Mohammed, S. (2026). Human rights and algorithmic accountability under the Nigeria Data Protection Act 2023. Scholarly Journal of Advanced Legal Research, 6(1), 1–9. https://doi.org/10.46654/6102-1848
Munung, N. S., Ewuoso, C., Chimusa, E. R., & Ogundiran, T. (2025). Cultivating an equity-oriented data sharing culture for African health research initiatives. Nature Communications, 16(1), Article 8122. https://doi.org/10.1038/s41467-025-63289-2
Munung, N. S., Royal, C., de Kock, C., Awandare, G. A., Nembaware, V., Nguefack, S., Treadwell, M., & Wonkam, A. (2024). Genomics and health data governance in Africa: Democratize the use of big data and popularize public engagement. Hastings Center Report, 54(Suppl. 2), S84– S92. https://doi.org/10.1002/hast.4933
Munung, N. S., Staunton, C., Mazibuko, O., Wall, P. J., & Wonkam, A. (2024). Data protection legislation in Africa and pathways for enhancing compliance in big data health research. Health Research Policy and Systems, 22(1), Article 145. https://doi.org/10.1186/s12961-024-01230-7
Mwogosi, A., & Simba, R. (2025). Digital policy and governance frameworks for EHR systems in Tanzania: A scoping review. Digital Policy, Regulation and Governance, 28(1), 52–74. https://doi.org/10.1108/dprg-11-2024-0289
Nienaber McKay, A. G., Brand, D., Botes, M., Cengiz, N., & Swart, M. (2024). The regulation of health data sharing in Africa: A comparative study. Journal of Law and the Biosciences, 11(1), Article lsad035. https://doi.org/10.1093/jlb/lsad035 Nigeria Data Protection Act, 2023 (Federal Republic of Nigeria).
Nigeria Data Protection Commission. (2025). Nigeria Data Protection Act General Application and Implementation Directive (NDPC/NDP ACT-GAID/01/2025).
Nyachowe, D. T., Bronstein, V., Robertson, H., Hazelhurst, S., Gardner, J., Ramsay, M., Owili, P. O., Klipin, M., Glover, K., Asiki, G., Odero, H. O., Mungai, P. C., Awuor, D., Iddi, S., Kisiangani, I., Nderitu, D. M., Masilela, N., Ohene-Kwofie, D., Kimongo, F., & MADIVA Research Hub and the DS-I Africa Consortium. (2025). Balancing protection of participants and other stakeholders with openness: African lessons from the MADIVA data sharing and access policy. Global Health Action, 18(1), Article 2590307. https://doi.org/10.1080/16549716.2025.2590307
Nyamawe, A., & Shao, D. (2026). On the use of synthetic data for healthcare AI in Africa: Technical performance, governance challenges, and policy readiness. Digital Health, 12, Article 20552076261418897. https://doi.org/10.1177/20552076261418897
Obasa, A. E., & Kabanda, S. (2026). Research ethics committees (RECs) perspectives on large language models and AI ethics review: A South African case. BMC Medical Ethics, 27(1), Article 206. https://doi.org/10.1186/s12910-026-01471-x
Obiora, O. L., Shead, D. A., & Olivier, B. (2024). Data sharing considerations and practice among health researchers in Africa: A scoping review. Digital Health, 10, Article 20552076241290955. https://doi.org/10.1177/20552076241290955
Ochasi, A., Mahamadou, A. J. D., Altman, R. B., & Nkwocha, L. U. C. (2025). Reframing justice in healthcare AI: An Ubuntu-based approach for Africa. Developing World Bioethics, 26(3), 146–155. https://doi.org/10.1111/dewb.70007
Olawade, D. B., Clement David-Olawade, A., Aderinto, N., & Wada, O. Z. (2026). Ethical oversight of artificial intelligence in Nigerian healthcare: A qualitative analysis of ethics committee members’ perspectives on integration and regulation. International Journal of Medical Informatics, 206, Article 106140. https://doi.org/10.1016/j.ijmedinf.2025.106140
Omutoko, L., Chingarande, G. R., Botes, M., Moyana, F., Singh, S., Jaoko, W., Sevene, E., Mtande, T., Edwin, A. K., Matandika, L., Burgess, T., & Moodley, K. (2024). Understanding and processing informed consent during data-intensive health research in sub-Saharan Africa: Challenges and opportunities from a multilingual perspective. Research Ethics, 21(3), 503–518. https://doi.org/10.1177/17470161241274809
Prinsen, L. (2024). Introducing dynamic consent for improved trust and privacy in research involving human biological material and associated data in South Africa. Frontiers in Genetics, 15, Article 1272924. https://doi.org/10.3389/fgene.2024.1272924
Rebai, A., Abayomi, A., Andanda, P., Kerr, R., Herbst, K., Mabuka, J., Wamuyu, R., Bukini, D., & Dandara, C. (2025). Responsible governance of genomics data and biospecimens in the context of broad consent: Experiences of a pioneering access committee in Africa. BMJ Global Health, 10(2), Article e016026. https://doi.org/10.1136/bmjgh-2024-
Sekalala, S., Lake, S. J., Nsengimana, J. P., Weiss, M., & Mpiima, J. (2026). Health before hype: A V-Model blueprint for African digital health and AI regulatory sandboxes. International Health. Advance online publication. https://doi.org/10.1093/inthealth/ihag067
Sengupta, A., & Mohandas, S. (2026). The imaginary of informed consent: Rethinking approaches to data use for AI in healthcare. Computer Law & Security Review, 61, Article 106309. https://doi.org/10.1016/j.clsr.2026.106309
Sihlahla, I., Donnelly, D. L., Townsend, B., & Thaldar, D. (2023). Legal and ethical principles governing the use of artificial intelligence in radiology services in South Africa. Developing World Bioethics, 25(1), 35–45. https://doi.org/10.1111/dewb.12436
Staunton, C., Edgcumbe, A., Abdulrauf, L., Gooden, A., Ogendi, P., & Thaldar, D. (2025). Cross-border data sharing for research in Africa: An analysis of the data protection and research ethics requirements in 12 jurisdictions. Journal of Law and the Biosciences, 12(1), Article lsaf002. https://doi.org/10.1093/jlb/lsaf002
Swales, L., Botes, M., Donnelly, D., & Thaldar, D. (2023). Towards a data transfer agreement for the South African research community: The empowerment approach. South African Journal of Bioethics and Law, 16(1), 13–18. https://doi.org/10.7196/SAJBL.2023.v16i1.827
Swales, L., Gooden, A., & Thaldar, D. (2024). The anatomy of a data transfer agreement for health research. Frontiers in Pharmacology, 15, Article 1332700. https://doi.org/10.3389/fphar.2024.1332700
Thaldar, D. (2023a). Does data protection law in South Africa apply to pseudonymised data? Frontiers in Pharmacology, 14, Article 1238749. https://doi.org/10.3389/fphar.2023.1238749
Thaldar, D. W. (2023b). POPIA does indeed apply to health research: A response to Bronstein and Nyachowe. South African Medical Journal, 113(11), 4–5. https://doi.org/10.7196/SAMJ.2023.v113i11.1345
Thaldar, D., Botes, M., Swales, L., & Esselaar, P. (2024). Enhancing data governance in collaborative research: Introducing SA DTA 1.1. South African Journal of Bioethics and Law, 17(2), Article e2300. https://doi.org/10.7196/sajbl.2024.v17i2.2300
Thaldar, D., & Bottomley, D. (2025). Public trust of AI in healthcare in South Africa: Results of a survey. BMC Medical Ethics, 26(1), Article 113. https://doi.org/10.1186/s12910-025-01272-8 (Correction published 2025, https://doi.org/10.1186/s12910-025-01293-3)
Townsend, B. A., Sihlahla, I., Naidoo, M., Naidoo, S., Donnelly, D. L., & Thaldar, D. W. (2023). Mapping the regulatory landscape of AI in healthcare in Africa. Frontiers in Pharmacology, 14, Article 1214422. https://doi.org/10.3389/fphar.2023.1214422
Victor, A. (2025). Artificial intelligence in global health: An unfair future for health in sub-Saharan Africa? Health Affairs Scholar, 3(2), Article qxaf023. https://doi.org/10.1093/haschl/qxaf023
Waithira, N., Kestelyn, E., Mukaka, M., Phuong, D. N. T., Chotthanawathit, K., Thanh, H. N., Odhiambo, R. A., Van Nuil, J., & Cheah, P. Y. (2026). Data reuse in global health: Perspectives from actors in policy, funding and research. BMJ Global Health, 11(3), Article e021974. https://doi.org/10.1136/bmjgh-2025-021974
Downloads
Published
Issue
Section
License
Copyright (c) 2026 IIAR Journal of Migration, Diaspora, and Population Mobility
This work is licensed under a Creative Commons Attribution 4.0 International License.
