Nigeria's Regulatory Landscape at a Glance
Nigeria's framework rests on the NDPA 2023, supervised by the Nigeria Data Protection Commission, supplemented by subsidiary instruments that carry the operational detail and by guidance inherited from the earlier NDPR regime. Sectoral requirements in financial services, communications, and health apply alongside.
The requirements applicable to an organisation depend on its activities, sector, processing operations, and regulatory status.
- Jurisdiction
- Nigeria
- Primary data protection framework
- Nigeria Data Protection Act 2023 (NDPA)
- Predecessor framework
- Nigeria Data Protection Regulation 2019 (NDPR), issued under NITDA
Key Regulations in Nigeria
Nigeria Data Protection Act 2023
The NDPA was signed into law in June 2023, replacing the regulation-based NDPR regime with primary legislation and establishing the Nigeria Data Protection Commission as an independent regulator. It applies where the data controller or processor is domiciled, resident, or operating in Nigeria, where processing occurs in Nigeria, or where a controller or processor not in Nigeria processes the personal data of data subjects in Nigeria.
Its structure follows international norms, with principles, lawful bases, data subject rights, impact assessments, and breach notification.
Depending on applicability, organisations may need to address:
- A lawful basis for processing, including consent and legitimate interests.
- Stricter conditions for sensitive personal data.
- Whether the organisation is of major importance and must register.
- Appointment of a data protection officer.
- Data protection impact assessments for high-risk processing.
- Security measures appropriate to the risk.
- Breach notification to the Commission and affected data subjects.
- Conditions for transferring personal data outside Nigeria.
Instruments and guidance issued under the earlier NDPR regime continue to inform practice where consistent with the Act.
Data Controllers and Processors of Major Importance
The Act's central organising concept is the data controller or data processor of major importance. This covers those domiciled, resident, or operating in Nigeria that process the personal data of more than a number of data subjects specified by the Commission, or that process personal data of particular value or significance to the economy, society, or security.
Being of major importance triggers mandatory registration with the Commission and exposure to the higher penalty tier.
Organisations assessing their status may need to consider:
- The number of data subjects whose personal data is processed.
- Whether the data is of particular value or significance to the economy or security.
- Whether the sector has been designated by the Commission.
- The registration deadline and particulars required.
- That the designation determines the applicable penalty tier.
The thresholds and designated categories are set by the Commission rather than in the Act, so they should be confirmed from current official sources.
Registration and Compliance Reporting
Data controllers and processors of major importance must register with the Commission within the period it specifies, providing particulars including contact details, the categories of personal data processed, purposes, recipients, transfers abroad, and details of the data protection officer.
The predecessor NDPR regime required annual compliance audit filings, and arrangements for periodic compliance reporting have continued under the Act through subsidiary instruments.
Organisations may need to consider:
- Whether registration as a controller, processor, or both is required.
- The particulars required and keeping them current.
- Periodic compliance reporting or audit filing obligations.
- Whether a licensed compliance organisation must be engaged.
- Renewal timetables set by the Commission.
Confirm the current reporting and filing requirements, as these were carried over and adapted from the NDPR regime through subsidiary instruments.
Breach Notification
Where a personal data breach is likely to result in a risk to the rights and freedoms of individuals, the data controller must notify the Commission within seventy-two hours of becoming aware of it, describing the breach, the categories and number of data subjects affected, the likely consequences, and the measures taken.
Where the breach is likely to result in a high risk, the controller must also communicate with the affected data subjects without undue delay and advise them of steps to mitigate the harm. A processor must notify its controller without undue delay.
Organisations responding to an incident may need to consider:
- The seventy-two hour period for notifying the Commission.
- Whether the high-risk threshold for notifying data subjects is met.
- Advice to data subjects on mitigating harm.
- Processor duties to inform the controller.
- Records of breaches and the assessments made.
Nigeria uses a two-threshold structure: a risk trigger for the Commission and a high-risk trigger for data subjects.
Cross-Border Transfers
A controller or processor may transfer personal data out of Nigeria where the recipient is subject to a law, binding corporate rules, contractual clauses, a code of conduct, or a certification mechanism affording an adequate level of protection, and the Act sets out the factors relevant to assessing adequacy.
Where adequacy is not established, transfers may proceed on enumerated bases including the data subject's consent after being informed of the risks, necessity for the performance of a contract, public interest, legal claims, and protecting vital interests.
Organisations transferring data out of Nigeria may need to consider:
- Whether adequacy can be established on the Act's factors.
- Which instrument provides the adequate protection relied upon.
- Which enumerated basis applies where adequacy is not established.
- Documentation of the assessment for the Commission.
- Onward transfers by the recipient.
Nigeria places the adequacy assessment on the exporting organisation rather than publishing an adequacy list.
Sectoral and Related Legislation
Other requirements apply alongside the Act, including Central Bank of Nigeria rules for banks and payment service providers, Nigerian Communications Commission requirements for licensees, the Cybercrimes Act, and consumer protection rules enforced by the Federal Competition and Consumer Protection Commission.
Sectoral considerations may include:
- Central Bank requirements on customer data and outsourcing.
- Communications licensee obligations on subscriber data.
- Cybercrimes Act provisions on data and systems.
- Consumer protection requirements on unsolicited contact.
- Health records and patient confidentiality rules.
Financial and communications sector rules have been enforced for longer than the NDPA and may be the more immediate constraint.
Who Needs to Comply With Nigerian Data Protection Law?
The NDPA and related requirements may apply to:
Organisations in Nigeria
Data controllers and processors domiciled, resident, or operating in Nigeria that process personal data.
International companies
Controllers and processors not in Nigeria that process the personal data of data subjects in Nigeria.
Organisations of major importance
Those meeting the Commission's thresholds or in designated sectors, which must register and face the higher penalty tier.
Processors
Service providers acting on a controller's instructions, which have their own duties and may themselves be of major importance.
Employers
Organisations handling employee and candidate data, including health and biometric data treated as sensitive.
Financial and telecoms businesses
Entities subject to Central Bank or Communications Commission requirements in addition to the NDPA.
The precise obligations depend on the organisation's role, processing activities, size, risk profile, and territorial scope.
Understanding Your Obligations Under the NDPA
Lawful Basis and Principles
Processing must rest on a lawful basis, which include consent, performance of a contract, a legal obligation, protection of vital interests, a public interest task, and the legitimate interests of the controller. Processing must be fair, lawful, transparent, for a specified purpose, adequate and not excessive, accurate, and retained no longer than necessary.
Consent must be freely given, specific, informed, and unambiguous, and the controller bears the burden of demonstrating it.
Registration Where of Major Importance
Organisations that are data controllers or processors of major importance must register with the Commission within the specified period, provide the required particulars, and keep the registration current.
Data Protection Officer
A data controller of major importance must designate a data protection officer with expert knowledge of data protection law and practices, who may be an employee or engaged under a service contract, and who reports to the highest level of management.
The officer's details form part of the registration particulars filed with the Commission.
Impact Assessments and Security
Where processing is likely to result in a high risk to the rights and freedoms of a data subject, an impact assessment must be carried out before processing. Appropriate technical and organisational measures must be implemented, and processors engaged under a written contract.
Breach Notification
Breaches likely to result in a risk to rights and freedoms must be notified to the Commission within seventy-two hours of awareness, and those likely to result in a high risk must also be communicated to affected data subjects without undue delay with mitigation advice.
Transfers
Transfers out of Nigeria require an adequate level of protection established through law, binding corporate rules, contractual clauses, a code of conduct, or certification, or reliance on one of the enumerated bases such as informed consent or contractual necessity.
Data Subject Rights Under the NDPA
The NDPA gives data subjects a number of rights over their personal data. Depending on the circumstances, these may include:
Right to Be Informed
Data subjects must be given information about the controller, the purposes, the legal basis, recipients, retention, and their rights.
Right of Access
Data subjects may confirm whether their personal data is being processed and obtain a copy of it and information about the processing.
Rectification
Data subjects may request correction of inaccurate personal data and completion of incomplete data.
Erasure
Data subjects may request deletion where the data is no longer necessary, consent is withdrawn, or processing is unlawful.
Restriction and Objection
Data subjects may request restriction of processing and object to processing, including for direct marketing.
Data Portability
Data subjects may receive their personal data in a structured, commonly used, machine-readable format and transmit it to another controller.
Controllers must respond within the period prescribed by the Act and may refuse only on the grounds it permits, giving reasons.
Nigeria's Regulatory Timeline
Nigeria moved from regulation to primary legislation in 2023.
- January 2019
NDPR Issued
The Nigeria Data Protection Regulation was issued under NITDA, establishing the first general data protection requirements and annual audit filings.
- 2020 to 2022
NDPR Implementation
A framework of implementation guidance, licensed compliance organisations, and annual audit filings developed under the regulation-based regime.
- June 2023
NDPA Signed Into Law
The Nigeria Data Protection Act 2023 replaced the regulation-based regime with primary legislation and established the Nigeria Data Protection Commission.
- 2024 onwards
Subsidiary Instruments
The Commission issued instruments and guidance giving operational effect to the Act, including on registration and compliance reporting.
Important: thresholds for major importance, registration deadlines, and compliance reporting requirements are set by the Commission and have developed through subsidiary instruments. Confirm the current position from official sources.
Data Protection Authorities in Nigeria
The Nigeria Data Protection Commission (NDPC) administers the NDPA, replacing the data protection functions previously exercised under NITDA. It issues subsidiary instruments and guidance, operates the registration regime, receives breach notifications and complaints, investigates, and may issue compliance orders and impose sanctions.
Other authorities are relevant depending on sector, including the Central Bank of Nigeria for banks and payment service providers, the Nigerian Communications Commission for licensees, and the Federal Competition and Consumer Protection Commission for consumer matters.
Guidance and instruments issued under the predecessor NDPR regime remain informative where consistent with the Act.
Penalties for Non-Compliance
The NDPA sets two penalty tiers keyed to the major importance designation. For a data controller or processor of major importance, the Commission may impose a remedial fee or penalty of the greater of ten million naira or two per cent of annual gross revenue in the preceding financial year. For others, the corresponding figures are the greater of two million naira or half of one per cent of annual gross revenue.
The Commission may also issue compliance orders requiring specified steps, order the payment of compensation to a data subject, and require an organisation to account for profits made through a violation. Failure to comply with an order is itself subject to sanction, and data subjects retain a right to seek compensation and to pursue civil remedies in the courts.
How RegulatoryBridge Supports Compliance in Nigeria
RegulatoryBridge helps organisations assess Nigeria's regulatory requirements and coordinate their compliance activities with wider international programmes.
NDPA Compliance Assessment
Review your processing activities, legal bases, notices, policies, governance arrangements, and operational controls to identify potential gaps.
Data Protection Officer and Registration Assessment
Review whether you are a data controller or processor of major importance, the registration that follows, and the data protection officer appointment the Act requires.
Data Subject Rights
Review request-handling processes, response timelines, privacy notices, and related documentation against the requirements applicable to you.
Breach Response and NDPC Notification
Evaluate breach assessment procedures, escalation responsibilities, NDPC notification readiness, and coordination between privacy, security, and legal teams.
International Data Transfers
Assess transfers out of Nigeria against the adequacy test and the enumerated bases, and the documentation the Commission expects.
Sectoral Compliance Coordination
Help organise requirements across the NDPA, financial sector rules, communications regulation, and health sector requirements.
Regulatory Monitoring
Monitor relevant developments and review compliance plans when legislation, NDPC guidance, or enforcement decisions change.
The scope of support is tailored to the organisation's activities, risk profile, and applicable legal requirements.
Our Approach to Nigeria Compliance
- 01
Identify Applicable Requirements
Assess your organisation's activities, role in processing personal data, industry, and connections to Nigeria.
- 02
Map Regulatory Obligations
Identify applicable provisions, relevant authorities, effective dates, and sector-specific requirements.
- 03
Conduct a Gap Assessment
Review existing policies, notices, consent mechanisms, contracts, security controls, and operational processes.
- 04
Develop a Compliance Roadmap
Prioritise remediation activities and establish owners, milestones, documentation requirements, and implementation plans.
- 05
Maintain Ongoing Readiness
Review regulatory developments, reassess relevant obligations, and update compliance processes when required.
Frequently Asked Questions About Nigeria Compliance
Need Nigerian NDPA support?
We support your major importance assessment, NDPC registration, and breach notification readiness - so your global product team doesn't have to.