Version: 2.0
Document status: Final
Effective date: 1 November 2026
Last updated: 1 November 2026
Platform: NYSC Ops Command Center Dashboard and Field App
Applicable jurisdiction: Federal Republic of Nigeria
Policy ownerData Protection Officer, NYSC National Directorate
Review cycle: At least once every twelve (12) months, and on any material change to the Platform, its providers or the law
CONTENTS
1. Introduction
2. Identity of the Data Controller and Other Responsible Parties
3. Scope of this Statement
4. Personal Data We Collect
5. Purposes and Lawful Bases of Processing
6. Biometric Authentication and Automated Clearance Decisions
7. Location Processing and Limitations
8. How Information is Shared
9. International Data Transfers
10. Cookies, Local Storage and Similar Technologies
11. Data Retention and Deletion
12. Data Security
13. Data Breaches and Security Incidents
14. Data Protection Governance and Impact Assessment
15. Rights of Data Subjects
16. Children and Age
17. Confidentiality, Authorized Access and User Responsibilities
18. Third-Party Links and External Services
19. Changes to this Statement
20. Complaints and Regulatory Oversight
21. Contact Us
22. Governing Law and Interpretation
KEY POINTS AT A GLANCE
This summary is a guide only. The numbered clauses that follow are the full Statement.
What NYSC Ops is. A restricted-access platform that NYSC uses to administer and verify monthly clearance of corps members.
What we collect. Your identity and posting details, a facial photograph and facial encoding, your GPS location when you clear, device and security information, clearance and SOS records, and, for administrators, account and activity records.
Why. To confirm that the person clearing is the registered corps member, that clearance happens within the assigned state, to keep the Platform secure, and to respond to emergencies.
Our legal basis. Mainly a legal obligation and the performance of NYSC’s public functions. We do not treat consent as the default basis.
Face and location data are sensitive. They have stricter access, security and retention rules.
A computer flag is not a finding of misconduct. Every adverse result is reviewed by a person, and you can ask for review.
Who sees your data. Only authorized NYSC personnel within their role and area, and providers that process data on NYSC’s instructions. We do not sell data or use it for advertising.
How long we keep it. Only as long as needed, under an approved retention period.
Your rights. You may ask to access, correct, restrict, object to, or in some cases erase your data, and may complain to the Nigeria Data Protection Commission.
1. INTRODUCTION
1.1 About the Platform
NYSC Ops is a restricted-access digital operations platform designed to support the administration, monitoring and verification of monthly clearance activities under the National Youth Service Corps (“NYSC”) programme in Nigeria. The Platform comprises:
The Ops Server, which processes application requests, manages records and communicates events between authorized applications.
The Command Center Dashboard, which enables authorized NYSC administrative personnel to monitor clearance activities and perform assigned administrative functions.
The Field App, which enables registered corps members to authenticate their identity and submit biometric and location-based clearance records.
1.2 Purpose of this Statement
This Privacy Statement and Personal Data Protection Policy explains the categories of personal data processed through the Platform, where the data comes from, the purposes and legal bases for processing, the circumstances in which information may be disclosed or transferred, the security safeguards applied, the retention and deletion arrangements, and the rights available to individuals whose personal data is processed. It is also the internal policy that binds everyone who administers or supports the Platform.
1.3 Nature of the Platform
The Platform is not a public social network, advertising service or general-purpose consumer application. Access is restricted to authorized users whose accounts have been provisioned through the Platform’s administrative arrangements.
1.4 Status and relationship with other documents
This Statement must be read together with the NYSC Ops Terms and Conditions, applicable NYSC administrative instructions, and any separate privacy notices or lawful directions governing the administration of the NYSC programme. If any provision of this Statement conflicts with a mandatory provision of law, the law prevails.
1.5 Definitions
In this Statement, unless the context requires otherwise:
“Act” means the Nigeria Data Protection Act 2023, and includes regulations, directives, guidance notes and codes issued under it by the Commission.
“Administrative User” means an NYSC officer or other authorized person holding a Dashboard account, including LGA Supervisors, State Coordinators, Zonal Inspectors, Administrators and Super Administrators.
“Biometric Data” means personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of a person that allows or confirms their unique identification, including facial images, facial encodings and liveness data.
“Clearance” means the periodic verification of a corps member’s presence and identity through the Field App.
“Commission” or “NDPC” means the Nigeria Data Protection Commission.
“Corps Member” means a person registered with NYSC and using the Field App.
“Data Controller” means the organization or public authority that, alone or jointly with others, determines the purposes and means of processing personal data.
“Data Processor” means a person or organization that processes personal data on behalf of a Data Controller under applicable contractual and legal arrangements.
“Data Subject” means the identifiable individual to whom personal data relates.
“DPIA” means a data protection impact assessment.
“DPO” means the Data Protection Officer designated under clause 2.5.
“Personal Data” means any information relating to an identified or identifiable individual.
“Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data.
“Processing” means any operation performed on personal data, including collection, recording, storage, use, disclosure, transfer, restriction, erasure and destruction.
“Sensitive Personal Data” has the meaning given in the Act and includes personal data relating to biometric identification, health, and other categories the Act designates as sensitive.
1.6 Interpretation
Headings are for convenience only. “Including” means “including without limitation”. A reference to a law includes that law as amended or replaced. The words “shall” and “must” state binding obligations; “may” states a permission or a possibility.
1.7 How we give you notice
This Statement is made available at onboarding and in the settings of the Field App, within the Dashboard, and on the official NYSC website. Short just-in-time notices will also be shown at the points where sensitive processing begins: before face capture, before the first location request, and before the SOS function is first used. The Platform shall record the version of this Statement presented to each user and the date it was presented. This Statement is written in English.
2. IDENTITY OF THE DATA CONTROLLER AND OTHER RESPONSIBLE PARTIES
2.1 Roles
The terms “Data Controller”, “Data Processor” and “Data Subject” have the meanings given in clause 1.5. Responsibility for processing follows the actual decisions about why and how personal data is used, not merely the name of the organization that hosts or builds the technology.
2.2 Data Controller
The Data Controller is the National Youth Service Corps, Plot 416, Tigris Crescent, Off Aguiyi Ironsi Street, Maitama, Abuja, which determines the purposes of clearance verification and the essential means by which personal data is processed on the Platform. Where another duly authorized public institution determines the purposes or essential means of any processing, that institution is identified in a written arrangement with NYSC and the arrangement is made available to individuals on request.
2.3 Platform Operator and Data Processor
The Platform is built and operated by EIB Stratoc Limited (RC 1952655). The Operator acts as a Data Processor and processes personal data solely on NYSC’s documented instructions under a written data processing agreement. That agreement shall cover subject matter and duration, the nature and purpose of processing, the categories of data and individuals, confidentiality, security, sub-processors, assistance with individual rights and breach handling, audit rights, and return or deletion of data at the end of the engagement. The identity of a technology or hosting provider does not, by itself, make that provider a Data Controller. If the Operator independently determines any purpose or essential means of processing, it becomes responsible for that processing, and its role shall be assessed and documented separately.
2.4 Sub-processors
The Operator may engage sub-processors, such as hosting, database, notification and backup providers, only with NYSC’s prior written authorization, under written terms that impose obligations no less protective than those in this Statement. The Operator remains responsible to NYSC for its sub-processors. NYSC shall maintain a current list of sub-processors, with their processing locations, and make it available to individuals on request.
2.5 Data Protection Officer
NYSC shall designate a Data Protection Officer with appropriate expertise, independence and resources. The DPO monitors compliance with the Act and this Statement, advises on impact assessments, acts as the contact point for individuals and for the Commission, and reports to the highest level of NYSC management on data protection matters. The DPO shall not be penalized for performing these duties.
Data Protection OfficerData Protection Officer, NYSC National Directorate
Privacy emailelujulo@eibstratoc.com
Postal addressPlot 416, Tigris Crescent, Off Aguiyi Ironsi Street, Maitama, Abuja
Telephone09076983705
2.6 Registration and regulatory filings
To the extent that NYSC or the Operator is a data controller or data processor of major importance under the Act, it shall register with the Commission, keep its registration current, and file the required annual compliance audit return and any other mandatory filings.
3. SCOPE OF THIS STATEMENT
3.1This Statement applies to personal data processed through:
the Field App used by Corps Members;
the Command Center Dashboard used by authorized administrative personnel;
the Ops Server and associated application programming interfaces;
the real-time communications and notification infrastructure;
the clearance, geofencing, biometric authentication and device-binding functions;
SOS alerts and related emergency records;
administrative audit logs, security records and incident investigations; and
any official support, review, privacy request or account administration channel operated in connection with NYSC Ops.
3.2It applies to Corps Members, NYSC officers, Administrative Users, Super Administrators, and any other individual whose information is processed in connection with the Platform, including a person who contacts a privacy or support channel.
3.3It also addresses cookies and similar technologies to the extent that these are used by the Dashboard, any associated web interface, or an official website used to access or administer the Platform.
3.4This Statement does not govern records that NYSC holds outside the Platform, which are covered by NYSC’s own notices, nor processing that a third party carries out for its own independent purposes.
4. PERSONAL DATA WE COLLECT
Personal data means any information about an individual from which that person can be identified. We collect and process only information that is necessary for identity verification, clearance administration, security, emergency response, Platform operation and accountability.
4.1 Identity and service information
For registered Corps Members, the Platform may process:
full legal name;
NYSC State Number and Call-up Number;
assigned state and Local Government Area (LGA);
Place of Primary Assignment (PPA);
Community Development Service (CDS) group;
email address, used for sign-in, one-time passwords and account recovery;
internal account identifiers and authentication references; and
clearance status and relevant service-administration records.
The NYSC State Number is used to identify the Corps Member within the clearance process. The Platform shall not use it for an unrelated purpose merely because it is available in the database.
For Administrative Users, the Platform may process email address, username, authentication and account-status information, assigned administrative role, assigned state, zone or LGA, and records of role changes, permissions and account administration.
4.2 Biometric information
The Field App uses facial verification to support identity authentication and clearance. Depending on the stage of the process, the Platform processes:
Reference facial photograph: a facial image captured during onboarding and retained as the reference image for identity verification.
Facial encoding vector: a numerical representation generated from a facial image and used for biometric comparison during later authentication or clearance.
Liveness verification information: information generated or evaluated during a challenge, such as a requested blink or head movement, to assess whether the person presenting for authentication is physically present.
Clearance selfie thumbnail: a low resolution facial image captured when a clearance submission is made and retained as part of the clearance audit record.
A facial encoding is not anonymous merely because it is represented by numbers; where it can be linked to an identifiable Corps Member or used to authenticate that person, it remains personal data.
The Platform is designed to use the stored facial encoding for comparison, rather than retransmitting the original reference photograph at every clearance. This does not mean that all facial images are deleted after registration: the onboarding reference image and the clearance selfie thumbnail are distinct records with different purposes.
Biometric processing is limited to the approved identity verification and clearance purposes. It shall not be used for advertising, unrelated profiling, facial surveillance outside the authorized workflow, matching against other databases without a separate lawful basis, or the development, testing or training of unrelated biometric or machine-learning products.
4.3 Location information
At the time of an active clearance submission, the Field App captures:
GPS latitude and longitude,
The GPS accuracy radius in metres,
Clearance and submission timestamp,
The state and LGA assigned to the Corp Member.
The result of the geofence check.
This is used to assess whether the submitted coordinates fall within the relevant assigned state boundary.
The Platform is not designed to track Corps Members continuously in the background. Position logs are generated only during active clearance sessions or other specifically authorized functions described in this Statement. Location data can nevertheless be sensitive in context because it can reveal where a person was at a particular time, so access is limited to personnel with an operational need. Clause 7 sets out further limits.
4.4 Device and technical information
The Platform may process:
Device identifier or device fingerprint;
Mobile operating system and version;
Field App version;
The push-notification token issued through Firebase Cloud Messaging (FCM);
Authentication and session timestamps;
Login attempts and device-binding events;
Application errors and technical diagnostics where collected;
IP addresses associated with authenticated administrative actions; and
Security events and other technical records generated by the system.
Device binding associates a Corps Member’s account with a registered mobile device. It reduces unauthorized account access and prevents a person from switching devices without the required administrative authorization. A Corps Member who loses, replaces or changes a device must report this through the designated channel so that the binding can be reviewed and, where appropriate, transferred after identity verification. Device identifiers and notification tokens are personal data where they are associated with an identifiable user or account.
4.5 Clearance records
For each accepted clearance submission, the Platform may retain:
The Corps Member identifier and relevant identity snapshot;
NYSC State Number and Call-up Number;
Assigned State and LGA;
Clearance session identifier and timestamp;
Submitted GPS coordinates and accuracy;
The biometric verification result or flag;
The geofence result or flag;
Clearance status;
The associated selfie thumbnail;
Relevant device and submission metadata.
The system is designed to reject duplicate submissions within the same clearance month, subject to the session configuration and the rules implemented. Clearance records support monthly verification, administrative monitoring, dispute resolution, auditability and authorized programme administration.
4.6 SOS and emergency information
Where a Corps Member activates the SOS function, the Platform may process:
The Corp Member’s account identifier;
GPS coordinates;
Date and time of the alert;
Device identifier and relevant app or operating system information;
Acknowledgement and escalation status;
and information relating to the response.
An SOS alert does not, by itself, establish that an emergency has occurred or that the individual has engaged in wrongdoing.
Emergency audio recording. The Platform specification provides for an authorized administrator to initiate an audio recording of approximately three minutes during an SOS event, stored in encrypted Amazon S3 storage. Because remote audio capture can intrude significantly on privacy, it is not an ordinary administrative power. It shall remain disabled, and the Field App shall not request microphone permission, unless and until NYSC has approved a written emergency-response protocol. The protocol shall specify:
the narrow circumstances in which remote recording is permitted, which shall be limited to a genuine and serious risk to life or safety;
the lawful basis and the necessity and proportionality of recording in that case;
who may initiate, who must approve, and who may access a recording, limited to the minimum personnel required for emergency response;
whether the person concerned is told that recording is taking place, with a visible indicator on the device where safe and appropriate;
how accidental, unauthorized or repeated activation is prevented;
the retention period and deletion process, and a prohibition on using recordings for any purpose unrelated to the emergency;
logging of every initiation and access, and prompt review of that log by the DPO; and
how misuse is investigated, recorded and sanctioned.
A reference to any recording is stored on the SOS event record. Where the actual implementation gives Administrators and Super Administrators access to recordings, that access shall be reviewed and reduced to the minimum necessary before the feature is enabled.
4.7 Administrative audit and security information
The Platform maintains audit records of administrative actions. These may include:
The actor’s email address and role.
IP address.
Date and time.
The action performed.
The target account or record.
Relevant action details.
Changes to roles, permissions or device bindings.
Clearance session opening and closing.
Manual clearance status changes.
Account creation, modification and deletion.
Announcement creation and deletion.
Geofence audit activity.
Other security relevant events.
Audit records are designed to be immutable through the application interface. This supports accountability but does not remove the need for a defined retention schedule, restricted access, secure backups and a lawful process for handling legally required corrections, restrictions or deletion requests.
4.8 Scheduling and announcements
The Platform may process scheduling information, including activity type, time, recurrence and state assignment, and announcements containing titles, message bodies, priority, target states or LGAs, timestamps and authorship. These records are used to communicate operational instructions and administer the clearance programme.
4.9 Support, review and privacy request records
When you contact an official support channel, request a review of a clearance result, make a privacy request or lodge a complaint, we process the contents of your communication, the information needed to verify your identity, the reference number, and a record of how the matter was handled and resolved.
4.10 Where the data comes from
Most identity and service information originates from NYSC’s registration and posting records and is loaded into the Platform by authorized administrators. Biometric, location, device and clearance data is generated when you use the Field App. Administrative and audit data is generated by the Platform and by Administrative Users’ actions. SOS response information is generated by NYSC responders. We do not obtain personal data about Corps Members from social media or commercial data brokers.
4.11 Whether providing data is required
Use of the Platform for clearance is required under the National Youth Service Corps Act, Cap N84, Laws of the Federation of Nigeria 2004, the NYSC Bye-Laws made under it, and lawful administrative directions issued by NYSC. Identity, face and location data are needed to complete clearance. If you do not provide them, or the Field App cannot obtain them, your clearance cannot be verified automatically; the alternative review route in clause 6.7 applies, and no adverse consequence follows merely because a technical check could not be completed. Provision of SOS data is voluntary and occurs only when you activate SOS.
4.12 Data the Platform does not collect
The Platform is not designed to collect your contacts, files, photographs from your device gallery, microphone audio (except under the restricted feature in clause 4.6), background location, financial information, health information, religion, ethnicity, political opinion or similar categories. If any such collection is later proposed, it requires a privacy review and prior notice to users.
4.13 Accuracy of your information
We take reasonable steps to keep personal data accurate and up to date. Corps Members should tell NYSC promptly if their details change, for example following redeployment or a change of PPA, state or LGA. Inaccurate data identified by NYSC is corrected, and the correction is recorded.
5. PURPOSES AND LAWFUL BASES OF PROCESSING
5.1 Principles
NYSC and its processors shall process personal data in accordance with the following principles:
Lawfulness, fairness and transparency: processing has a lawful basis, is fair to the individual and is explained in this Statement.
Purpose limitation: data is collected for specified, explicit and legitimate purposes and is not processed in a manner incompatible with them.
Data minimization: data is adequate, relevant and limited to what is necessary.
Accuracy: data is kept accurate and corrected without undue delay.
Storage limitation: data is kept in identifiable form no longer than necessary.
Integrity and confidentiality: data is protected against unauthorized or unlawful processing and against loss or damage.
Accountability: NYSC can demonstrate compliance through documentation, governance and audit.
5.2 Purposes
Personal data is processed for the following purposes only:
Identifying Corps Members and administering clearance.
Verifying identity and preventing impersonation.
Verifying that clearance takes place within the assigned state.
Recording and auditing clearance outcomes.
Securing accounts and devices and investigating security incidents.
Delivering official notices; responding to SOS alerts.
Maintaining administrative accountability.
Handling support, review, privacy and complaint requests.
Meeting legal obligations.
Data may also be used in anonymized, aggregated form for programme planning and reporting, provided no individual can be identified. Identifiable personal data shall not be used to train or improve machine learning models other than the approved verification function, and shall not be used for any incompatible purpose without a fresh lawful basis and, where required, prior notice.
5.3 Lawful bases relied on
NYSC may rely on one or more of the lawful bases recognized under the Nigeria Data Protection Act 2023. In this Platform they apply as follows:
Legal obligation: processing necessary to comply with a legal duty, including where the use of the Platform for clearance is mandatory for Corps Members under NYSC’s enabling law and lawful directions.
Public interest and official authority: processing necessary for a task carried out in the public interest or in the exercise of official public authority vested in NYSC. This is the principal basis for clearance and verification.
Vital interests: processing necessary to protect the life or physical safety of the individual or another person, such as using an SOS location to send help.
Contract: limited to Administrative Users whose account data is necessary to perform, or to take steps before entering, their employment or service arrangement. It is not relied on for Corps Members.
Legitimate interests: NYSC does not rely on this basis for the performance of its public tasks. It may be relied on only for limited ancillary purposes, such as network and information security measures, where a documented assessment shows that the interests are not overridden by the individual’s rights and freedoms.
Consent: used only for genuinely optional features, if any (clause 5.6).
5.4 Processing activities and lawful bases
The table below sets out the lawful basis relied on for each processing activity.
Table 1: Processing activities, purposes and lawful bases
Processing activity
Data involved
Purpose
Lawful basis
Corps Member account and service information
Name, State Number, state, LGA, PPA, CDS group, email, account identifiers
Identify Corps Members and administer clearance
Legal obligation; public interest and official authority
Facial reference photograph and facial encoding
Reference image, encoding vector
Authenticate identity and reduce impersonation
Legal obligation or public task, together with the additional condition for Sensitive Personal Data in clause 5.5
Liveness verification
Challenge results
Confirm the person is physically present
As above, with the condition in clause 5.5
GPS capture and geofence checks
Coordinates, accuracy, timestamp, geofence result
Verify that a submission falls within the assigned-state boundary
Legal obligation; public interest and official authority
Clearance record creation and selfie thumbnail
Clearance records, thumbnail, flags
Record and verify clearance outcomes; audit and dispute resolution
Legal obligation; public interest and official authority
Device binding
Device identifier, binding events
Prevent unauthorized access and enforce device controls
Public interest and official authority; legitimate interests for security only where assessed and documented
Push notifications
FCM token, notice content
Deliver clearance results and authorized operational notices
Public interest and official authority (service administration)
Administrative audit logs
Actor, role, IP, action, target, time
Accountability, security and traceability
Legal obligation; public interest and official authority; contract (for staff)
Administrator account data
Email, username, role, area, status
Provision and control of Dashboard access
Contract or legal obligation; public interest and official authority
Scheduling and announcements
Activity details, messages, targets, authorship
Communicate operational instructions
Public interest and official authority
SOS alerts and emergency location
Account ID, coordinates, time, status
Facilitate emergency assessment and response
Vital interests; public interest; legal obligation as applicable
Emergency audio recording (restricted; clause 4.6)
Audio recording
Support a specifically authorized emergency response
Separately assessed basis, vital interests where strictly applicable, with safeguards in the approved protocol
Security monitoring and incident investigation
Logs, IP, device and session data
Detect unauthorized access and investigate incidents
Legal obligation; public interest and official authority
Support, review, privacy-request and complaint handling
Communications, verification details, outcomes
Resolve requests and disputes; meet statutory duties to individuals
Legal obligation; public interest and official authority
Anonymized statistics and reporting
Aggregated, non-identifiable data
Programme planning and reporting
Processing of data that no longer identifies individuals; public interest and official authority for the anonymization step
5.5 Sensitive Personal Data
Biometric data used for identification or authentication falls within, or may fall within, the category of Sensitive Personal Data under the Act. Before biometric processing begins, the Data Controller shall identify and document both a lawful basis and the additional condition required for that category of data, together with the necessity and proportionality of using biometrics rather than a less intrusive method.
5.6 Consent
Consent is not treated as the default basis for any processing activity. In an institutional or service-year context, the relationship between the parties may prevent consent from being freely given. Where consent is relied upon, it must be freely given, specific, informed and unambiguous, be demonstrable, be as easy to withdraw as to give, and withdrawal must not prejudice the individual, except where another lawful basis independently authorizes continued processing.
5.7 Documentation
This table is supported by a documented record of processing activities and a lawful-basis assessment for each activity. Where processing is necessary for NYSC’s statutory functions, NYSC shall identify the specific legal mandate, and any directive relied on, and be able to demonstrate that the processing is necessary and proportionate to it.
6. BIOMETRIC AUTHENTICATION AND AUTOMATED CLEARANCE DECISIONS
6.1 How automated clearance works
The Platform uses automated checks to evaluate biometric matching and geographic boundaries. The clearance workflow may include:
an identity or liveness challenge.
capture of a location fix
submission of the relevant biometric vector and supporting information
comparison against the stored reference encoding of the account holder (one-to-one verification)
a geofence test against the assigned-state boundary
generation of a clearance outcome; and
notification of the result and recording of the event.
6.2 Possible outcomes
A submission may be marked CLEARED where the required checks pass, FLAGGED where the geofence check fails, or subjected to a retry cooldown where biometric verification fails, in accordance with the configured rules.
6.3 Limits of automated results
Automated results may contain errors. A failed match or out-of-state flag may arise from poor lighting, camera quality, network conditions, GPS inaccuracy, device malfunction, changes in appearance (such as injury, illness, a new hairstyle or facial hair, or protective or cultural face coverings) or other technical circumstances. A FLAGGED or failed result is a technical indicator and shall not be treated as proof of deliberate misconduct or as a final disciplinary finding.
6.4 Human review and fair procedure
No adverse administrative consequence shall follow from an automated result alone. Any such consequence must be determined by an authorized NYSC officer in accordance with applicable NYSC rules, procedural fairness and meaningful human review. The reviewing officer shall have the authority and information to depart from the automated result, shall consider any explanation or evidence the Corps Member provides, and shall record the outcome and reasons.
6.5 Matters to be documented before deployment
Before the Platform is deployed, the Data Controller shall document:
the logic and thresholds used for biometric matching and geofencing
the consequences of failed checks
how a Corps Member may request a review, and the response time
the person or office responsible for reviewing disputed results, who shall be independent of the original administrative action where practicable.
the handling of false positives and false negatives; and
the application of any right not to be subject to solely automated decisions producing legal or similarly significant effects.
Where a decision falls within statutory protections concerning automated decision-making, the Platform shall support the applicable safeguards, including meaningful human intervention and an opportunity to express a view and contest the decision.
6.6 Requesting a review
A Corps Member who disagrees with a clearance result may request review through the NYSC Ops support channel (support@nysc.online), quoting the clearance session reference where known. NYSC shall acknowledge the request within three (3) working days and give a reasoned outcome within ten (10) working days. If the outcome is not satisfactory, the Corps Member may escalate to the Director, Corps Mobilisation, NYSC National Directorate and may exercise the rights in clause 15 and complain under clause 20.
6.7 Alternative verification and reasonable accommodation
Where a Corps Member cannot reliably complete face verification or location capture, for example because of disability, injury, a medical or physical change in appearance, a faulty or incompatible device, or persistently poor GPS signal, NYSC shall provide a documented alternative verification route, such as in-person verification by a designated officer. The Corps Member shall not be treated as absent or dishonest merely because the technology could not complete a check.
6.8 Safeguards for biometric data
NYSC shall ensure that biometric data is:
encrypted in transit and at rest;
accessible only to the minimum personnel and systems required;
never exported to unauthorized systems or devices;
not used for one-to-many identification or matching against other databases;
separated from general administrative data where practicable; and
deleted in accordance with clause 11.
Liveness detection shall be used to resist presentation attacks such as photographs, screen replays and masks.
6.9 Accuracy testing and monitoring
Before deployment and periodically afterwards, NYSC shall test the biometric function for accuracy, including false match and false rejection rates across different skin tones, ages, genders, lighting conditions and device cameras; review the results; and adjust thresholds or processes to reduce unfair or discriminatory outcomes. A summary of the outcome shall be reported to the DPO.
7. LOCATION PROCESSING AND LIMITATIONS
7.1Location data is collected for clearance verification and authorized SOS response functions.
7.2The Field App is designed to request foreground location access only, and not continuous background tracking. Position logs are generated only during active clearance sessions and SOS events, subject to the actual implementation.
7.3Users should keep location services enabled when needed for clearance. Disabling location access, providing inaccurate information, or using a device that cannot obtain a reliable GPS fix may prevent the system from completing verification.
7.4Where location cannot be obtained or its accuracy is insufficient, NYSC shall provide a documented exception or review procedure rather than assuming that the Corps Member was absent or acted dishonestly.
7.5A location result is a technical indicator, not conclusive proof of attendance, misconduct or fraud. GPS inaccuracies, weak signals, device settings, buildings, terrain, weather and other conditions may affect it.
7.6Location information shall not be used to monitor unrelated movements, infer private activities or establish presence at a place beyond what is necessary for the approved purpose. Access is limited to personnel with an operational need, and access to location records is logged.
7.7SOS location is captured only when the Corps Member activates SOS, or as the approved emergency protocol otherwise authorizes, and is used for emergency response and the related record only.
8. HOW INFORMATION IS SHARED
Personal data may be accessed or disclosed only where necessary for an authorized purpose and subject to applicable law, confidentiality obligations and access controls.
8.1 Authorized NYSC personnel
Information is made available to authorized personnel according to their assigned role and geographic scope:
LGA Supervisors: read-only access to relevant records within their assigned LGA, as configured.
State Coordinators: access to clearance administration and relevant Corps Member information within their assigned state.
Zonal Inspectors: read and limited edit access for their assigned zone, subject to configured permissions.
Administrators: broader operational access necessary for their assigned duties.
Super Administrators: system-wide administrative access, including user management and session configuration, held by the smallest practicable number of named individuals.
These descriptions summarize the intended role model; the deployed access-control matrix shall be verified before launch and reviewed at least every six months. Role-based access does not authorize an officer to browse, disclose or use personal information for private purposes. Every Administrative User remains subject to the confidentiality, acceptable-use and security obligations.
8.2 Technology and infrastructure providers
The Platform is designed to use third-party infrastructure and services, including:
Amazon Web Services (AWS), London region (eu-west-2), United Kingdom, for application hosting, caching and content delivery;
Amazon RDS for PostgreSQL, in the same AWS region, for structured data storage;
Amazon S3, in the same AWS region, for encrypted file and audio storage;
Firebase Cloud Messaging, a Google service, for push notifications; and Send Byte, for transactional email such as one-time passwords and service notices.
Depending on the deployed configuration, other providers may process authentication, network, monitoring, backup or diagnostic information. Before personal data is processed by any provider, the Data Controller shall document the provider’s actual role, the data involved, its processing locations, relevant sub-processors, security measures, retention arrangements and any international transfers, and shall put a written agreement in place. The use of a named service does not establish that all data is stored in Nigeria; actual storage locations, backup locations, support access and sub-processors shall be verified contractually and technically.
8.3 Disclosure required or permitted by law
Personal data may be disclosed where required by a valid legal obligation, court order, or lawful request from a competent authority, including the Commission and law-enforcement or security agencies acting within their statutory powers, or where disclosure is otherwise permitted by law. Each request shall be verified for authenticity and legal basis, and recorded, including what was disclosed, to whom and on what authority. Disclosure shall be limited to the information reasonably necessary for the lawful purpose, and the individual shall be told of it where the law permits and doing so would not prejudice an investigation.
8.4 Emergency disclosures
Where an SOS event presents a credible risk of serious harm, relevant information may be disclosed to authorized emergency responders or competent authorities where a lawful basis exists, and the disclosure is necessary and proportionate. The disclosure and its reasons shall be recorded.
8.5 Oversight and audit bodies
Information may be made available to NYSC’s internal auditors, the Commission, and other bodies with a lawful oversight function, limited to what the function requires and subject to confidentiality.
8.6 Change of Operator or institutional reorganization
If the Operator changes, or NYSC’s functions are restructured or transferred, personal data shall be transferred only to a successor that is bound by obligations at least as protective as this Statement, and individuals shall be notified of material changes. On termination of an Operator’s engagement, the Operator shall return or securely delete all personal data as NYSC directs and certify that it has done so.
8.7 No sale and no advertising use
NYSC Ops is not designed to sell personal data or to share it with third parties for their independent marketing or advertising purposes. Personal data shall not be used to build advertising profiles or to send unrelated commercial promotions.
9. INTERNATIONAL DATA TRANSFERS
9.1The Platform is intended for operation in Nigeria. Nevertheless, the use of foreign-hosted infrastructure, overseas support personnel, remote technical access, international backups or foreign sub-processors may result in personal data being transferred outside Nigeria or accessed from another jurisdiction. At present, the Platform is hosted in the Amazon Web Services London region (United Kingdom), so personal data processed on the Platform is stored outside Nigeria, and clause 9.2 applies to that transfer.
9.2 Before any transfer, the Data Controller shall:
identify the recipient, destination country and categories of data transferred
determine the applicable transfer mechanism under the Nigeria Data Protection Act 2023 and the relevant Commission directives, such as an adequacy decision, binding corporate rules, contractual clauses or another recognized instrument.
assess the adequacy of protection and any applicable legal requirements.
put in place the required contractual, organizational and technical safeguards.
document the transfer and the associated risk assessment; and
disclose the material transfer arrangements to affected individuals as required by law.
9.3Where required, the relevant adequacy decision, approved transfer instrument or other legally recognized mechanism must be established before the transfer occurs. Encryption alone does not make an otherwise unlawful international transfer permissible.
9.4Push-notification content shall be minimal and shall not include biometric, SOS or other sensitive details, because notification services process content outside Nigeria.
10. COOKIES, LOCAL STORAGE AND SIMILAR TECHNOLOGIES
10.1 Scope
Cookies are small data files placed on a device by a website or web application. Similar technologies include local storage, session storage, authentication tokens, software development kit identifiers and other mechanisms used to maintain a session or remember a setting. The Command Center Dashboard may use browser storage or similar technologies to support authentication, security, session continuity and functionality. The Field App may use device storage and application tokens that are not technically browser cookies but perform related functions. The precise technologies used shall be confirmed through a technical cookie and storage audit before issue.
10.2 Categories of technology
Strictly necessary technologies support secure authentication, session management, CSRF or other request-integrity protection, load balancing and routing, security controls, and remembering a required security or privacy setting. They may be used without optional analytics consent where legally permitted and genuinely necessary to provide a service the user has requested.
Functional technologies remember user selected settings, such as interface preferences, where implemented.
Analytics and performance technologies measure application reliability, error rates or aggregate usage, if implemented. They must be configured to minimize personal data and must not be activated until the lawful basis, and any consent requirement have been assessed.
Advertising and cross-site tracking technologies are not used. The Platform is not designed to use advertising cookies, behavioural advertising identifiers or cross-site marketing trackers. If that changes, this Statement and the consent mechanisms must be updated before implementation.
10.3 Controls
Where non-essential technologies are used and consent is required, users shall be given a clear choice before they are activated, with a practical way to accept, reject and later change optional preferences. Rejecting optional technologies shall not prevent access to functions that do not reasonably require them. The final cookie notice shall identify each technology, its provider, purpose, type, data collected and retention period. No cookie name, provider or expiry period shall be published without verification.
10.4 Mobile application storage and permissions
The Field App’s device identifier, FCM token and authentication information are not necessarily cookies but are covered by this Statement where they are personal data. The app shall request only the permissions required for its disclosed functions. According to the current specification, these are camera access, foreground location access, internet access and push notifications. The app is not specified to request contacts, external storage, microphone access or background location. Microphone access would be requested only if the restricted feature in clause 4.6 is approved and enabled. Any later introduction of a new permission must undergo a privacy and security review and be explained to users before or when the change takes effect.
10.5 How users may control technologies
You may be able to manage browser cookies through your browser settings and mobile permissions through your device settings. Disabling strictly necessary session or security technologies, or required permissions, may prevent sign in or clearance. A privacy preference mechanism shall be provided where required by the technologies deployed and applicable law.
11. DATA RETENTION AND DELETION
11.1Personal data shall be retained only for as long as necessary for the documented purpose, subject to applicable legal, administrative, audit and recordkeeping obligations. The Data Controller shall approve a written retention schedule before production deployment. The periods below are proposed and must be confirmed by the Data Controller before issue.
Table 2: Retention schedule
Data category
Retention period
Corps Member profile and account data
For the authorized service-administration period and any justified subsequent recordkeeping period
Reference facial photograph
Only for the approved biometric-verification period; delete when no longer necessary, subject to lawful preservation requirements
Facial encoding vector
Only while required for authorized biometric authentication or clearance, subject to the approved retention schedule
Liveness verification data
Not retained beyond the verification session, except the pass or fail result held in the clearance record
Clearance selfie thumbnail
For the documented audit and dispute-resolution period
GPS and position logs
For the shortest period necessary for clearance verification, investigations and applicable recordkeeping duties
Clearance records
For the approved clearance audit and administrative retention period
SOS event records
For the period necessary for incident response, investigation and lawful recordkeeping
Emergency audio recordings (if the feature is enabled)
For a specifically approved, limited period tied to the emergency response purpose, unless an open investigation or legal proceedings require longer
Authentication and device records
For the period necessary for account security, session administration and investigation
FCM tokens
Until invalidated, replaced or no longer required for notifications
Backups
Rotated in accordance with documented backup and secure deletion procedures
11.2This table does not establish that any particular period has been approved.
11.3When a retention period expires, the information shall be securely deleted, anonymized where appropriate, or placed beyond ordinary use where a lawful preservation requirement applies. Deletion shall be by methods that prevent recovery, such as secure overwriting or destruction of encryption keys, and shall be verified and logged.
11.4Where a legal hold, investigation or lawful preservation obligation requires longer retention, access shall be restricted, the reason documented, and the hold reviewed at regular intervals and released when it ends.
11.5Immutable audit records are not exempt from data-protection obligations. Where a record cannot be edited through the application interface, the Data Controller shall maintain a controlled procedure for appending corrections, recording disputes, restricting access where appropriate and addressing lawful deletion obligations.
11.6Backups and replicated records are covered by a documented deletion process, including the handling of information that cannot immediately be removed from immutable backup media. Such information shall be isolated and not restored to production without re-applying deletions.
11.7The retention schedule shall be reviewed at least annually. Deletion jobs shall be automated where practicable, with periodic confirmation that they have run.
12. DATA SECURITY
12.1 Approach
NYSC and the Operator shall implement appropriate technical and organizational measures, proportionate to the risk and to the sensitivity of biometric, location and government-linked data, to protect personal data against unauthorized access, unlawful processing, accidental loss, destruction, alteration and disclosure. Data protection by design and by default shall be applied: new features are assessed for privacy before development, and the most privacy protective settings apply unless a justified need exists.
12.2 Technical safeguards in the specification
TLS-protected HTTPS and WSS communications.
Password hashing using bcrypt for administrative passwords.
Short-lived JWT access tokens and revocable refresh tokens.
Role-based and geographic access controls.
Device binding for Corps Member authentication.
Server-side storage of structured records in PostgreSQL.
Restricted access to reference facial photographs.
Server-side encryption for audio recordings stored in Amazon S3.
Administrative audit logging.
Restricted access to SOS recordings and other sensitive records.
These are the controls described in the product specification. Their configuration and effectiveness shall be verified before the Platform is represented as secure or compliant.
12.3 Additional safeguards
Multi-factor authentication for privileged Administrative Users.
Least-privilege access and periodic access reviews.
Encryption and access control for biometric data, databases, backups and exports.
Key management and rotation of secrets and credentials.
Rate limiting, abuse detection and protection against credential attacks.
Secure development practices, dependency management and vulnerability testing.
Independent penetration testing before launch and at least annually, with remediation of critical findings.
Monitoring privileged access and of suspicious data exports or bulk queries.
Incident response and disaster recovery procedures, with defined recovery objectives.
Staff confidentiality obligations and security and data-protection training.
Documented backup restoration tests.
Periodic review of third-party provider security and access arrangements, including support access to production data.
12.4 Limits
No electronic system can be guaranteed to be entirely free of risk. This does not remove our responsibility to apply appropriate safeguards, to test them, and to respond properly to incidents.
13. DATA BREACHES AND SECURITY INCIDENTS
13.1A Personal Data Breach may include unauthorized access, disclosure, alteration, loss, destruction or unavailability of personal data, whether caused by an external attack, an insider, a system fault or human error.
13.2If a breach is suspected, responsible personnel shall promptly escalate it through the approved incident-response process. Any Operator or sub processor that becomes aware of a breach affecting NYSC data shall notify NYSC without undue delay and in any event within twenty-four (24) hours. The response shall include:
containment and preservation of relevant evidence;
assessment of the nature and scope of the incident;
identification of affected systems, records and individuals;
evaluation of risks to individuals;
engagement with relevant technology providers;
remediation and prevention of recurrence;
documentation of the incident and the decisions made; and
notification to the Commission and to affected individuals where required by law.
13.3Where a breach is likely to result in a risk to the rights and freedoms of individuals, the Data Controller shall notify the Commission within seventy-two (72) hours after becoming aware of it, as the Act requires. Where the breach is likely to result in a high risk to individuals, the Data Controller shall also notify them without undue delay, in clear language, describing the nature of the breach, the likely consequences, the measures taken, and a contact point for further information.
13.4The 72-hour period is not a blanket rule requiring notification of every technical incident regardless of whether it is a reportable breach. The applicable legal test shall be applied to the circumstances and the reasoning recorded.
13.5The Data Controller shall keep a register of all Personal Data Breaches, including those not notified, with their effects and remedial action, and shall maintain a clear allocation of responsibilities between the Data Controller, the Operator and service providers for detection, escalation, investigation and notification.
14. DATA PROTECTION GOVERNANCE AND IMPACT ASSESSMENT
14.1 Accountability measures
NYSC shall be able to demonstrate compliance with the Act. It shall:
maintain a record of processing activities and the lawful-basis assessments.
adopt and enforce written data protection, retention, access-control, incident-response and acceptable-use policies.
enter into written processing agreements with the Operator and every other processor.
train staff and Administrative Users.
conduct periodic internal reviews and an annual data protection compliance audit and file the compliance audit return with the Commission where required.
maintain the register of breaches, the log of rights requests and the log of disclosures.
report to senior management at least annually on compliance, incidents and rights requests.
14.2 Data Protection Impact Assessment
Because NYSC Ops combines biometric identification, location verification, government-related identifiers, automated clearance checks, large-scale administrative monitoring and emergency-response functionality, a formal DPIA shall be completed and approved before production deployment. The assessment shall consider:
the necessity and proportionality of biometric verification.
the risks of false matches and false rejections.
the consequences of an incorrect clearance flag.
the risks associated with geolocation inaccuracies.
the possibility of device compromise or identity impersonation.
the risk of misuse by privileged administrators.
the privacy implications of remote audio capture.
the effects of centralized records and real-time monitoring.
risks to individuals arising from unauthorized disclosure.
the adequacy of retention and deletion periods;
international transfers and third-party provider access; and
alternatives that would achieve the same purpose with less intrusive processing.
14.3 Outcomes and review
Where the assessment identifies high residual risks, the Data Controller shall determine the mitigation, consultation with the Commission, or other action required under applicable law before processing begins. The DPIA shall be reviewed and updated whenever the Platform changes materially, including the introduction of new data types, features, permissions or providers, and at least annually.
15. RIGHTS OF DATA SUBJECTS
15.1 Your rights
Subject to the Nigeria Data Protection Act 2023 and any lawful limitations applicable to the particular processing, individuals may have the right to:
Be informed: receive clear information about how their personal data is processed.
Access: request confirmation of processing and access to their personal data, subject to applicable legal restrictions.
Rectification: request correction of inaccurate or incomplete information.
Erasure: request deletion where the applicable legal conditions are satisfied.
Restriction: request restriction of processing in circumstances provided by law.
Object: object to processing where the relevant statutory conditions apply.
Data portability: request their data in a portable format where the right applies.
Withdraw consent: withdraw consent where consent is the lawful basis, without affecting the lawfulness of processing carried out before withdrawal.
Challenge automated decisions: exercise applicable rights relating to decisions based solely on automated processing, including requests for human intervention where required.
Lodge a complaint: complain to the Commission or pursue other available legal remedies.
These rights are not absolute in every circumstance. For example, an erasure request may be subject to a lawful retention requirement, and portability may not apply to every record or lawful basis. Any refusal or restriction must be based on the applicable law and communicated with reasons.
15.2 How to submit a request
A Corps Member or Administrative User may submit a request through:
Email: elujulo@eibstratoc.com
Postal address: Data Protection Officer, NYSC National Directorate, Plot 416, Tigris Crescent, Off Aguiyi Ironsi Street, Maitama, Abuja
Telephone: 09076983705
In person or in writing to the Data Protection Officer at NYSC National Directorate
A request should identify the individual sufficiently to permit secure verification, describe the information or right concerned, and include any relevant reference number. A request may be made by an authorized representative who provides written authority and proof of identity. Requests need not cite the Act or use a particular form.
15.3 Verification, timing and cost
We may ask for additional information where reasonably necessary to verify identity or clarify a request. Verification must be proportionate and shall not require unnecessary collection of additional sensitive data. We shall acknowledge a request and respond within the period prescribed by law. Where an extension, refusal or restriction is legally permitted, the individual shall receive an explanation and be told of the right to complain to the Commission. Requests are handled free of charge unless the law allows a fee for manifestly unfounded or excessive requests.
15.4 Correction of clearance records
Where an individual disputes a clearance outcome, they may request review through the designated NYSC administrative channel. The review process shall distinguish between correcting inaccurate profile information; correcting a demonstrable technical or recording error; reviewing a biometric or geofence flag; and challenging the administrative consequence of a clearance result. A request for review does not automatically result in deletion of an audit record. Where the original event must be preserved, the system shall record the correction, dispute, review outcome or supplementary note in a traceable manner.
15.5 Account closure, deletion and data export
The current Platform specification does not provide an in-app account deletion or data-export mechanism for Corps Members. Until an approved self-service process is introduced, requests are handled through the designated privacy or NYSC administrative channel, and a copy of the individual’s personal data shall be provided in a commonly used electronic format on a valid access request. An administrator’s ability to delete a Corps Member’s application record does not necessarily mean that every copy, backup, immutable audit entry or legally required record is deleted. All deletion decisions follow the approved retention and preservation rules, and the individual shall be told what has and has not been deleted, and why.
15.6 Non-discrimination
No individual shall be treated less favourably for exercising a right under this clause.
16. CHILDREN AND AGE
16.1The Platform is designed primarily for registered NYSC Corps Members and authorized adult Administrative Users.
16.2If the Platform processes information relating to a person who is under the age of eighteen (18) years, the age below which the Act treats a person as a child, the Data Controller shall apply the additional safeguards and legal requirements relevant to that person’s age and circumstances, including consent of a parent or guardian where required.
16.3The Platform shall not assume that all users are adults without an appropriate basis for that assumption. Registration records shall be checked for date of birth, and any discrepancy shall be escalated to the DPO.
17. CONFIDENTIALITY, AUTHORISED ACCESS AND USER RESPONSIBILITIES
17.1 Administrative Users
All users with access to personal data must comply with their assigned permissions, confidentiality obligations, security procedures and applicable laws. Administrative Users shall sign a confidentiality and acceptable use undertaking before receiving access. Users must not:
access records without an authorized operational purpose.
share credentials or authentication tokens.
export, copy or disclose personal data without authorization.
photograph or reproduce restricted Dashboard information for unauthorized purposes.
use personal data for personal, political, commercial or retaliatory purposes.
attempt to bypass access controls.
retain downloaded records beyond an approved period.
use the Platform to stalk, intimidate or improperly monitor a Corps Member.
Suspected misuse may result in access suspension, investigation, disciplinary action, contractual consequences or referral to a competent authority, as applicable. Access shall be removed promptly when a user changes role or leaves NYSC.
17.2 Corps Members
Corps Members are asked to protect their account and device by using:
A screen lock.
Not to share their device or account, or to clear on behalf of another person.
To use only their own face and genuine location when clearing, and not to use software that alters or falsifies location or camera input;
To keep their information accurate;
To report a lost, stolen or compromised device without delay.
Deliberate impersonation or manipulation of the clearance process is a matter that NYSC may treat under its rules after human review and fair procedure.
17.3 Reporting concerns
Anyone who suspects misuse of personal data, or a breach, should report it to the DPO. Reports made in good faith shall be investigated, and the person reporting shall not be penalized.
18. THIRD-PARTY LINKS AND EXTERNAL SERVICES
18.1The Platform may depend on third-party infrastructure or direct users to external services. Their own privacy notices may apply to processing they carry out independently, and this Statement does not replace a third party’s privacy notice where that provider independently determines its processing purposes and means.
18.2The Data Controller shall nevertheless assess the providers engaged to process NYSC Ops data and put in place appropriate contractual and operational safeguards.
18.3NYSC is not responsible for the content or privacy practices of websites or services it does not control. Users should read the notices of any external service before using it.
19. CHANGES TO THIS STATEMENT
19.1This Statement may be updated to reflect changes in applicable law, institutional requirements, the Platform’s features, service providers or data-processing practices.
19.2Material changes shall be communicated through an appropriate official channel, such as an in-app notice, a Dashboard banner or an official announcement, reasonably before they take effect. Where a change requires renewed consent, consultation or another legal step, that step shall be completed before the new processing begins. Continued use of the Platform is not treated as consent where the law requires a fresh act of consent.
19.3A revision date and version number shall be displayed at the beginning of this Statement. Previous versions shall be retained, with their dates of effect, for accountability, and made available on request.
20. COMPLAINTS AND REGULATORY OVERSIGHT
20.1If an individual believes that their personal data has been processed unlawfully or that their data-protection rights have been infringed, they may contact the designated DPO or privacy office in the first instance.
20.2NYSC shall acknowledge a complaint within three (3) working days, investigate it impartially, and give a reasoned written response within thirty (30) days, or tell the complainant the reason for any delay.
20.3An individual may also lodge a complaint with the Nigeria Data Protection Commission through its official channels, or seek other remedies, including in the courts.
20.4The availability of an internal complaint channel does not remove any statutory right to approach the Commission or seek other remedies available under Nigerian law.
21. CONTACT US
Questions, requests or complaints concerning this Statement may be directed to:
Data ControllerNational Youth Service Corps, Plot 416, Tigris Crescent, Off Aguiyi Ironsi Street, Maitama, Abuja
Data Protection OfficerData Protection Officer, NYSC National Directorate
Emailelujulo@eibstratoc.com
Postal addressPlot 416, Tigris Crescent, Off Aguiyi Ironsi Street, Maitama, Abuja
Telephone09076983705
Official privacy request channelBy email to elujulo@eibstratoc.com, or in writing to the postal address above, marked “Privacy Request – NYSC Ops”
Platform Operator (Data Processor)EIB Stratoc Limited (RC 1952655), Plot 859 Bintu Shettima Road, Idu Industrial Area, Idu, Abuja, FCT
22. GOVERNING LAW AND INTERPRETATION
22.1This Statement shall be interpreted consistently with the laws of the Federal Republic of Nigeria, including the Constitution of the Federal Republic of Nigeria 1999 (as amended), in particular the right to privacy; the Nigeria Data Protection Act 2023; the General Application and Implementation Directive and other directives and guidance of the Nigeria Data Protection Commission in force. The Nigeria Data Protection Regulation 2019 to the extent it continues to apply; the National Youth Service Corps Act; the Cybercrimes (Prohibition, Prevention, etc.) Act 2015 as amended; the Freedom of Information Act 2011 to the extent applicable to NYSC; and other applicable law.
22.2Nothing in this Statement excludes, restricts or waives a right or obligation that cannot lawfully be excluded, restricted or waived.
22.3If any provision of this Statement is held to be invalid or unenforceable, the remaining provisions continue in effect.
22.4Where this Statement is translated, the English text prevails in the event of inconsistency.