Nigeria Data Protection Act (NDPA) 2023

An Act establishes robust rules for the handling and protection of personal data across Nigeria. It mandates the Nigeria Data Protection Commission and requires large data processors to register and conduct annual audits. The law imposes significant fines for non-compliance, ensuring accountability for data privacy.

What Is This Policy?

The Nigeria Data Protection Act (NDPA) 2023, enacted on 12 June 2023, is Nigeria's principal data protection legislation establishing the legal framework for the collection, processing, storage, and transfer of personal data, and creating the Nigeria Data Protection Commission (NDPC) as the independent supervisory authority.

Who Does It Target?

Data controllers and processors operating in Nigeria or processing data of Nigerian residents Data Controllers/Processors of Major Importance (DCPMI) — entities processing data of more than 200 data subjects in a 6-month period or providing commercial ICT services Private and public sector organisations collecting personal data Nigerian data subjects whose personal information is processed

What Does It Aim to Achieve?

Protect the privacy and personal data rights of Nigerian citizens and residents Establish a transparent, rights-based framework aligned with global data protection standards (GDPR-influenced) Create a credible regulatory body (NDPC) with enforcement and licensing powers Enable Nigeria to participate in international data-sharing frameworks

Key Features

Nigeria Data Protection Commission (NDPC): New independent regulatory authority replacing the NDPR regime under NITDA DCPMI Registration: Entities processing data of more than 200 data subjects in 6 months must register and file Annual Compliance Audit Returns (CARs) Data Subject Rights: Rights to access, rectification, erasure, and objection to processing High Penalties: Fines up to ₦10 million or 2% of annual gross revenue for non-compliance Data Transfer Restrictions: Cross-border transfers only to countries with adequate protection or under approved safeguards

Legal Framework

Constitution of the Federal Republic of Nigeria 1999 (right to privacy); National Information Technology Development Agency Act; cybercrimes (Prohibition, Prevention, etc.) Act 2015; African Union Convention on Cyber Security and Personal Data Protection

Current Status

In force. The NDPA came into effect on 12 June 2023. The NDPC has been constituted and is issuing guidance, registering DCPMIs, and enforcing compliance across public and private sector data processors.