NDPA / GAID

Nigeria Privacy

Status

NDPA in force (assented 13 June 2023). GAID issued 20 March 2025, effective 19 September 2025; it replaces the NDPR 2019 and its 2020 Implementation Framework.✓Sources: ndpc.gov.ng, dlapiperdataprotection.com, aelex.com, banwo-ighodalo.com

Who it applies to

Controllers and processors domiciled, resident or operating in Nigeria. Under the GAID, 'operating in Nigeria' includes targeting Nigerian data subjects without a local presence (extraterritorial).✓Sources: ncc.gov.ng, ndpc.gov.ng, dlapiperdataprotection.com

Size thresholds

'Major importance' (must register): more than 200 data subjects in 6 months, or set sectors regardless of volume (finance, health, insurance, e-commerce, etc.). Tiers: >200, >1,000, >5,000 subjects.✓Sources: ndpc.gov.ng, dlapiperdataprotection.com

Regulator

Nigeria Data Protection Commission (NDPC)✓Sources: ncc.gov.ng, dlapiperdataprotection.com

Breach or incident reporting

Notify the NDPC within 72 hours of becoming aware of a breach likely to risk individuals' rights; notify affected people immediately if high risk.✓Sources: ncc.gov.ng, ndpc.gov.ng, dlapiperdataprotection.com

Deadline to answer personal data requests

No fixed response deadline in the NDPA or GAID; requests must be handled without unreasonable delay, and erasure without undue delay.✓Sources: ncc.gov.ng, ndpc.gov.ng, banwo-ighodalo.com

Data protection officer

Mandatory for data controllers/processors of major importance; may be an employee or contractor. GAID adds DPO credential assessment and certification.✓Sources: ncc.gov.ng, ndpc.gov.ng, aelex.com

Local representative

No local representative requirement in the NDPA or GAID; foreign entities targeting people in Nigeria are treated as 'operating in Nigeria'.✓Sources: ncc.gov.ng, ndpc.gov.ng, dlapiperdataprotection.com

Sending data abroad

Allowed to NDPC-assessed adequate jurisdictions, or using a Cross-Border Data Transfer Instrument, or exceptions (explicit consent, contract, legal claims).✓Sources: ncc.gov.ng, dlapiperdataprotection.com

Cookies and consent

Consent is one of six lawful bases; it must be affirmative, informed and withdrawable (silence or pre-ticked boxes are not consent). Under the GAID, non-essential cookies need consent through a conspicuous banner seen without scrolling, and privacy and cookie notices must be on the homepage.✓Sources: ncc.gov.ng, ndpc.gov.ng, dlapiperdataprotection.com

Maximum penalty

Major importance: greater of 2% of prior-year gross revenue or NGN 10 million. Others: greater of 2% or NGN 2 million.✓Sources: ncc.gov.ng, dlapiperdataprotection.com

Facts marked “Being verified” are still being confirmed and are not given as answers.

What you must do✓

• Count data subjects over 6 months to see if you are of major importance; register in the right tier.
• Pay the registration fee (NGN 10,000 / 100,000 / 250,000 by tier).
• File your annual Compliance Audit Return by 31 March if you are in the Extra-High or Ultra-High tier.
• Appoint a certified DPO if you are of major importance.
• Report breaches to the NDPC within 72 hours.
• Use a DPIA and meet GAID pre-deployment checks before using AI, IoT or blockchain.
• Record a legitimate-interest assessment before relying on that basis.

Recent changes

GAID issued 20 March 2025, effective 19 Sept 2025: revised CAR filing fees and a 31 March deadline, DPO credential assessment, a standard DPIA template, cookie-consent and emerging-tech rules, and an explicit extraterritorial targeting test. Registration tiers come from the NDPC's February 2024 guidance notice.✓

Sources

• Primary source: https://ndpc.gov.ng/
• Second source: https://www.dlapiperdataprotection.com/index.html?t=law&c=NG
• Regulator: Nigeria Data Protection Commission (NDPC)

✓ = confirmed by two independent sources, at least one official. How we verify

Information only, not legal advice. Laws change; confirm with the regulator or a qualified lawyer before relying on this page. Spotted an error? Email contact@glancedeskjurisdiction.com.