Home › Compare laws side by side › NDPA / GAID vs EU GDPR

NDPA / GAID vs EU GDPR

Nigeria Data Protection Act 2023, with the NDPA General Application and Implementation Directive (GAID) 2025 (Nigeria) compared with Regulation (EU) 2016/679 (General Data Protection Regulation) (European Union (EEA)) on the same topics. Every value comes from the law pages, which link to the official sources.

Topic	NDPA / GAID Nigeria ✓ Confirmed by two sources	EU GDPR European Union (EEA) ✓ Confirmed by two sources
Status	NDPA in force (assented 13 June 2023). GAID issued 20 March 2025, effective 19 September 2025; it replaces the NDPR 2019 and its 2020 Implementation Framework.✓	In force since 25 May 2018. Digital Omnibus amendments proposed Nov 2025, not adopted as of Oct 2026.✓
Who it applies to	Controllers and processors domiciled, resident or operating in Nigeria. Under the GAID, 'operating in Nigeria' includes targeting Nigerian data subjects without a local presence (extraterritorial).✓	Any organisation processing personal data in the context of an EU establishment, plus non-EU organisations that offer goods/services to people in the EU or monitor their behaviour there.✓
Size thresholds	'Major importance' (must register): more than 200 data subjects in 6 months, or set sectors regardless of volume (finance, health, insurance, e-commerce, etc.). Tiers: >200, >1,000, >5,000 subjects.✓	None — applies regardless of size. Limited record-keeping relief for organisations under 250 staff (Art 30(5)), lost if processing is risky, not occasional, or includes special-category or criminal data.✓
Regulator	Nigeria Data Protection Commission (NDPC)✓	National data protection authorities (DPAs), coordinated by the European Data Protection Board (EDPB)✓
Breach or incident reporting	Notify the NDPC within 72 hours of becoming aware of a breach likely to risk individuals' rights; notify affected people immediately if high risk.✓	Notify the competent supervisory authority without undue delay and within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to individuals (Art 33). If you have an EU main establishment, that is your lead authority; if you have no EU establishment (even with an EU representative), notify the authority of every member state where affected people live (EDPB Guidelines 9/2022, para 73). Tell affected individuals without undue delay if the risk is high (Art 34).✓
Deadline to answer personal data requests	No fixed response deadline in the NDPA or GAID; requests must be handled without unreasonable delay, and erasure without undue delay.✓	1 month from receipt; extendable by 2 further months for complex requests if the person is told within the first month. Free of charge unless manifestly unfounded or excessive.✓
Data protection officer	Mandatory for data controllers/processors of major importance; may be an employee or contractor. GAID adds DPO credential assessment and certification.✓	DPO mandatory for public bodies, and where core activities involve large-scale regular and systematic monitoring, or large-scale processing of special-category or criminal-offence data.✓
Local representative	No local representative requirement in the NDPA or GAID; foreign entities targeting people in Nigeria are treated as 'operating in Nigeria'.✓	Non-EU controllers/processors caught by Art 3(2) must appoint an EU representative in writing, unless processing is occasional, low-risk and excludes large-scale sensitive data, or they are a public body.✓
Sending data abroad	Allowed to NDPC-assessed adequate jurisdictions, or using a Cross-Border Data Transfer Instrument, or exceptions (explicit consent, contract, legal claims).✓	Transfers outside the EEA need an adequacy decision (e.g. UK, Switzerland, EU-US Data Privacy Framework), or safeguards such as Standard Contractual Clauses or Binding Corporate Rules, or a narrow Art 49 derogation.✓
Cookies and consent	Consent is one of six lawful bases; it must be affirmative, informed and withdrawable (silence or pre-ticked boxes are not consent). Under the GAID, non-essential cookies need consent through a conspicuous banner seen without scrolling, and privacy and cookie notices must be on the homepage.✓	Cookie/tracker consent is governed by the ePrivacy Directive Art 5(3); where consent is the GDPR legal basis it must be freely given, specific, informed, unambiguous and as easy to withdraw as to give.✓
Maximum penalty	Major importance: greater of 2% of prior-year gross revenue or NGN 10 million. Others: greater of 2% or NGN 2 million.✓	Up to EUR 20 million or 4% of total worldwide annual turnover, whichever is higher (lower tier: EUR 10 million or 2%).✓

= confirmed by two independent sources, at least one official.

Facts marked “Being verified” are still being confirmed and are not given as answers.

Who each law applies to

NDPA / GAID: Controllers and processors domiciled, resident or operating in Nigeria. Under the GAID, 'operating in Nigeria' includes targeting Nigerian data subjects without a local presence (extraterritorial).
EU GDPR: Any organisation processing personal data in the context of an EU establishment, plus non-EU organisations that offer goods/services to people in the EU or monitor their behaviour there.

What you must do under NDPA / GAID

Count data subjects over 6 months to see if you are of major importance; register in the right tier.
Pay the registration fee (NGN 10,000 / 100,000 / 250,000 by tier).
File your annual Compliance Audit Return by 31 March if you are in the Extra-High or Ultra-High tier.
Appoint a certified DPO if you are of major importance.
Report breaches to the NDPC within 72 hours.
Use a DPIA and meet GAID pre-deployment checks before using AI, IoT or blockchain.

Full NDPA / GAID page, sources and checklist

What you must do under EU GDPR

Identify a lawful basis for every processing purpose and record it.
Publish a clear privacy notice covering purposes, recipients, retention and rights.
Keep a record of processing activities and sign Art 28 contracts with processors.
Run a DPIA before high-risk processing such as large-scale profiling or sensitive data.
Report qualifying breaches within 72 hours (lead authority, or every relevant DPA if you have no EU establishment) and log all breaches.
Answer access, erasure and other rights requests within one month.

Full EU GDPR page, sources and checklist

Information only, not legal advice. Laws change; confirm with the regulator or a qualified lawyer before relying on this page. Spotted an error? Email contact@glancedeskjurisdiction.com.