NDPA Policy Summary

Nigeria Data Protection Act (NDPA 2023) Nigeria Data Protection Commission — Federal Republic of Nigeria

What Is This Policy?

The Nigeria Data Protection Act (NDPA) is Nigeria's comprehensive primary legislative framework for the protection of personal information of natural persons residing or doing business in Nigeria. It replaces the Nigeria Data Protection Regulation (NDPR) 2019 — which was subsidiary legislation issued under NITDA — and establishes a standalone regulatory commission with full statutory powers. The Act aligns Nigeria's data protection framework with international standards (including GDPR principles), boosts confidence in the digital economy, and provides clear obligations for organisations that collect and process personal data.

Who Does It Target?

Data controllers and processors operating in Nigeria or processing the personal data of persons in Nigeria Data controllers and processors of major importance (DCPMIs) — entities processing large volumes of data or data of high sensitivity Public institutions at Federal, State, and Local Government levels that process personal data Private sector businesses, foreign companies, and multinationals with data touchpoints in Nigeria Individual data subjects — Nigerian citizens, residents, and non-nationals whose data is processed in Nigeria

What Does It Aim to Achieve?

Safeguard the fundamental right to privacy guaranteed under Section 37 of the 1999 Constitution Establish a robust primary legal framework replacing fragmented subsidiary regulations Create an independent Nigeria Data Protection Commission (NDPC) with full enforcement powers Promote lawful, secure, and transparent processing of personal data by all controllers and processors Protect data subject rights — including access, correction, portability, objection, and deletion Restrict cross-border transfer of personal data except where legally permitted Strengthen Nigeria's digital economy and participation in regional and global data economies

Key Features

Establishment of the NDPC: The Act creates the Nigeria Data Protection Commission (NDPC) — replacing the former Nigeria Data Protection Bureau (NDPB). The NDPC is independent in the performance of its functions and is governed by a Governing Council chaired by a retired judge of a superior court. Tiered Obligations (DCPMIs): Introduces a tiered category of 'Data Controllers and Processors of Major Importance' (DCPMIs), inspired by the EU Digital Services Act approach. DCPMIs face enhanced obligations including mandatory registration with the NDPC, annual Compliance Audit Returns (CAR), and appointment of a Data Protection Officer (DPO). Data Processing Principles: Section 24 mandates that personal data be collected lawfully and processed securely. Section 25 defines lawful bases for processing, including data subject consent, contractual necessity, legal obligation, and legitimate interests. Data Subject Rights: Sections 34–37 guarantee data subjects the right to access, correct, and delete their data; the right to data portability; the right to object to processing; the right to withdraw consent; and qualified rights against automated decision-making (ADM). Cross-Border Transfer Restrictions: Personal data may not be transferred outside Nigeria except where the destination country provides adequate protection or other permitted legal bases apply (Section 42 on adequacy). Data Protection Impact Assessments (DPIAs): Data controllers are required to conduct DPIAs for high-risk processing activities, with additional obligations for breach notification and data security.

Current Status

Rollout Stage: Active — NDPA signed June 12, 2023; GAID (General Application and Implementation Directive) issued March 20, 2025 and effective September 19, 2025, replacing the NDPR 2019 Regulatory Body: Nigeria Data Protection Commission (NDPC) fully operational, replacing the NDPB DCPMI Registration: All data controllers and processors of major importance required to register with NDPC within six months of commencement Compliance Audit Returns: DCPMIs established before June 12, 2023 must file CAR annually by March 31; those established after must file within 15 months of establishment Audits: Data controllers processing personal data of 2,000+ data subjects within 12 months must file an audit report with the NDPC by March 15 each year Enforcement: Commission empowered to issue compliance orders, enforcement orders, investigate complaints, and apply for warrants for evidence How to Access / Comply Data Controllers & Processors: Register with the NDPC if classified as a DCPMI; update privacy notices, consent mechanisms, and data retention policies to comply with the NDPA Public Institutions: Follow NDPC guidelines for public institutions; ensure all personal data processing aligns with NDPA principles and the GAID Data Subjects: Lodge complaints with the NDPC for violations of data subject rights; pursue civil remedies and judicial review where applicable Foreign Companies: Assess applicability of the Act to cross-border data processing involving Nigerian data subjects; implement data transfer safeguards Contact: Nigeria Data Protection Commission (NDPC): ndpc.gov.ng | Federal Ministry of Communications, Innovation & Digital Economy

Important Terms

Impact & Metrics

Nigeria became one of the last major African economies to enact a primary data protection law, ending reliance on the subsidiary NDPR 2019 The Act is expected to boost investor confidence in Nigeria's digital economy by providing legal certainty for data processing operations Cross-border data transfer restrictions align Nigeria with international standards, supporting participation in global digital trade Enhanced enforcement powers — including warrants, compliance orders, and civil penalties — significantly strengthen data subject remedies compared to the NDPR regime The tiered DCPMI framework mirrors the EU's Digital Services Act, introducing proportionate compliance obligations based on risk and scale

Official Resources

Website: ndpc.gov.ng | nitda.gov.ng | dataguidance.com Policy Document: Nigeria Data Protection Act 2023 — available via the Nigeria Data Protection Commission and the Federal Ministry of Communications, Innovation & Digital Economy Contact: Nigeria Data Protection Commission (NDPC), Abuja Summary prepared using the Policy Summary Template | Source: NDPA 2023, NDPC, Banwo & Ighodalo, KPMG Nigeria, Future of Privacy Forum, DataGuidance, DLA Piper | March 2026

Legal Framework

The Nigeria Data Protection Act (NDPA) 2023 is the primary data privacy legislation. It establishes the Nigeria Data Protection Commission and derives constitutional authority from Section 37 of the 1999 Constitution (right to privacy). The Act aligns with the EU General Data Protection Regulation (GDPR) principles, the ECOWAS Supplementary Act on Personal Data Protection, and the African Union Convention on Cyber Security and Personal Data Protection.