Setting up the private file directory (nginx)
Have a look at Perusio's config, it has all the information and explanation you need. Here is a quote from it:


  This config assumes that private files are stored under a directory
  named private. I suggest sites/default/files/private or
  sites/&lt;sitename&gt;/files/private but can be anywhere inside the site
  root as long as you keep the top level directory name private. (...)
  Example: Calling the top level private files directory protected
  instead of private.

location ^~ /sites/default/files/protected {          
  internal;        
}

  
  Now any attempt to access the files under this directory directly will
  return a 404.


... 


  The usual practice involves setting up a directory outside of
  files directory and giving write permissions to the web server user.
  (...)  I think it to be less advisable, in the sense that now there's another directory that is writable by the server.
  
  I prefer to use a directory under files, which is the only one that is
  writable by the web server, and use the above location (protected or
  private) to block access by the client to it.


In short, marking it as internal is enough.