NDPA 2023 and the GAID 2025: What Nigerian Businesses Must Do Now

The Nigeria Data Protection Act 2023 (NDPA) is Nigeria's main data protection law and set up the Nigeria Data Protection Commission (NDPC). In March 2025 the NDPC issued the General Application and Implementation Directive (GAID) 2025, which took effect on 19 September 2025. The GAID explains how organisations must comply, and it replaced the old Nigeria Data Protection Regulation 2019 and its implementation framework.

Who the NDPA applies to

The NDPA applies to organisations that process the personal data of people in Nigeria, including organisations based outside Nigeria.

Key obligations

1. A lawful basis for processing

Every use of personal data needs a lawful basis. The NDPA recognises six: consent, contract, legal obligation, vital interests, public interest or official authority, and legitimate interests. Record which one you rely on for each activity.

2. Rights of individuals

People have the right to be informed, to access their data, to have it corrected or deleted, to withdraw consent, to data portability, and not to be subject to decisions made purely by automated processing in certain cases. You need a process to handle these requests on time.

3. Registration and a Data Protection Officer

Organisations the NDPC classes as data controllers or processors of major importance must register with the NDPC and appoint a Data Protection Officer. Under the GAID they fall into three levels, ultra high, extra high and ordinary high, with yearly registration fees of ₦250,000, ₦100,000 and ₦10,000 respectively.

4. Compliance audit returns

Organisations in the ultra high and extra high levels must file a yearly compliance audit return through a licensed Data Protection Compliance Organisation, normally by 31 March. For the 2025 returns the NDPC extended the deadline to 30 May 2026. Late filing attracts a surcharge.

5. Data protection impact assessments

Carry out an impact assessment before processing that is likely to pose a high risk to people, such as large scale processing of sensitive data or new technologies.

6. Data breaches

Report a breach that is likely to put people's rights at risk to the NDPC within 72 hours of becoming aware of it. Where the risk to people is high, tell them without delay.

7. Transfers outside Nigeria

Personal data can only be sent abroad where the NDPA's conditions are met, such as adequate protection in the destination country or another lawful basis.

Penalties

Under section 48 of the NDPA, the NDPC can impose a penalty of:

• For data controllers and processors of major importance: up to ₦10 million or 2% of annual gross revenue in the previous financial year, whichever is higher
• For others: up to ₦2 million or 2% of annual gross revenue, whichever is higher

The NDPC can also order an organisation to fix the breach and pay compensation to people affected.

Enforcement is real

In August 2024 the NDPC fined Fidelity Bank ₦555.8 million. In early 2026 it said it had concluded 246 investigations and would step up enforcement, including against organisations that fail to file audit returns.

Compliance checklist

• Map the personal data you collect, where it is stored and who can access it
• Update your privacy notice
• Record the lawful basis for each use of personal data
• Set up a process for data subject requests
• Check whether you are of major importance, then register and appoint a DPO if so
• File your compliance audit return on time if it applies to you
• Put a breach response plan in place
• Review contracts with vendors who handle personal data for you
• Train your staff