e. before transferring personal data outside Nigeria; and f. before making a decision based on automated processing which produces legal effects concerning or significantly affecting the data subject. 6. What measures do we have to put in place to process, or continue processing personal data for other public institutions, a private entity or an international organisation? Public institutions seeking to access and use the personal information collected or stored by another statutory body, private entity or international organisation need to put measures in place to ensure the confidentiality, integrity, availability and resilience of personal data. More specifically, public institutions need to: