d) the organisation possesses critical national information infrastructure (as defined under the Cybercrimes (Prohibition, Prevention, Etc.) Act 2015 or any amendment thereto) consisting of Personal Data. 3.5 Data Protection Officer in a Multinational Company The Nigerian subsidiary of a multinational company to which paragraphs 3.4.1 above apply, shall appoint a DPO who shall be based in Nigeria and shall be given full access to the Management in Nigeria. The DPO of the Nigerian subsidiary may report to a global DPO where such exists. 3.6 Liability of a DPO Notwithstanding any contractual, civil or criminal liability, a DPO shall not be personally liable for the organisation’s non-compliance with applicable data protection laws. 3.7 Qualities of a DPO A DPO shall be chosen with due regard to the nature of the organisation’s Processing activities and the data protection issues that arise within the organisation. A DPO shall have: a. professional expertise in Nigerian data protection laws and practices; b. an in-depth understanding of applicable data protection laws; and c. requisite knowledge to do the following: i. inform and advise the organisation, Management, employees and third parties processors of their obligations under the NDPR; ii. monitor compliance with the NDPR and with the organisation's own data protection objectives; 9|Page