7.2 NITDA shall coordinate transfer requests with the office of the Attorney-General of the Federation (‘AGF’). A ‘white-list’ of jurisdictions (the ‘White List’) has been compiled and is set out in Annexure C to this Framework. Where transfer to a jurisdiction outside the White List is being sought, the Data Controller shall ensure there is a verifiable documentation of consent to one or more of the exceptions stated in Article 2.12 of the NDPR. 7.3 Data Transfer to subsidiaries or headquarters outside Nigeria Where an organization seeks to transfer personal data to another entity within its group of companies or an affiliate company, it would suffice for the organization to provide a Binding Corporate Rule (BCR) or sign a Standard Contracting Clauses (SCC) to be adopted by industry and NITDA. The BCR or SCC may be included in the data audit report or submitted separately to NITDA. 8.0 RETENTION OF RECORDS (Art. 2.1(1c) NDPR) 8.1 The Regulation does not explicitly provide for a time period for the retention of data, because the retention period in certain scenarios may be subject to existing laws or contractual agreements. Every data Controller Report shall specify the duration of storage clearly in its terms of service or other binding document. 8.2 Where the retention period of Personal Data is not specified in the contract between the parties or by applicable law, the retention period shall be: a) 3 (three) years after the last active use of a digital platform b) 6 (six) years after the last transaction in a contractual agreement c) Upon presentation of evidence of death by a deceased’s relative d) immediately upon request by the Data Subject or his/her legal guardian where (i) no statutory provision provides otherwise and 18 | P a g e