appropriate safeguards for data protection in the foreign country. The Data Subject shall have the right to obtain from the Controller without undue delay the rectification of inaccurate Personal Data concerning him or her. Considering the purposes of the processing, the Data Subject shall have the right to have incomplete Personal Data completed, including by means of providing a supplementary statement. (9) The Data Subject shall have the right to request the Controller to delete Personal Data without delay, and the Controller shall delete Personal Data where one of the following grounds applies: a) the Personal Data are no longer necessary in relation to the purposes for which they were collected or processed; b) the Data Subject withdraws consent on which the processing is based; c) the Data Subject objects to the processing and there are no overriding legitimate grounds for the processing; d) the Personal Data have been unlawfully processed; and e) the Personal Data must be erased for compliance with a legal obligation in Nigeria. (10) The Controller who has made the Personal Data public and is obliged to delete the Personal Data shall, take all reasonable steps, to inform Controllers processing the Personal Data of the Data Subject’s request. (11) The Data Subject shall have the right to obtain from the Controller restriction of processing where one of the following applies: a) The accuracy of the Personal Data is contested by the Data Subject for a period enabling the Controller to verify the accuracy of the Personal Data; b) The processing is unlawful, and the Data Subject opposes the erasure of the Personal Data and requests the restriction of their use instead; c) The Controller no longer needs the Personal Data for the purposes of the processing, but they are required by the Data Subject for the establishment, exercise or defence of legal claims; and 16 NIGERIA DATA PROTECTION REGULATION