Nigeria NDPA
Amended Nigeria · In force Jun 12, 2023 · no upcoming deadlines
Deadlines
| Date | What happens | When |
|---|---|---|
| Jun 12, 2023 | NDPA signed into law3.3 years ago | 3.3 years ago |
| Sep 19, 2025 | GAID 2025 takes effect12 months ago | 12 months ago |
Summaries for reference, not legal advice. Check the official text.
What it does
Nigeria's primary data protection statute, establishing the NDPC, lawful bases, data subject rights, 72-hour breach notification, and special duties for data controllers and processors of major importance (registration, DPO, compliance audits). The GAID 2025 supersedes the NDPR 2019 and its Implementation Framework with detailed rules on audits, DPIAs, transfers and more.
- Who it applies to
- Controllers and processors domiciled or operating in Nigeria, or processing personal data of data subjects in Nigeria. 'Data controllers/processors of major importance' designated by NDPC thresholds (tiered by number of data subjects processed).
- Penalties
- Data controllers/processors of major importance: higher of NGN 10 million or 2% of annual gross revenue in the preceding financial year; others: higher of NGN 2 million or 2% of annual gross revenue.
- Enforced by
- Nigeria Data Protection Commission (NDPC)
- Official name
- Nigeria Data Protection Act, 2023 and NDPA General Application and Implementation Directive (GAID) 2025
- Citation
- Nigeria Data Protection Act, 2023
- Topics
- privacy, breach-notification, data-residency
Research notes
GAID was issued in March 2025 (exact issuance date not verified). Status marked 'amended' because GAID materially changed implementing rules in 2025.
Related
Israel Privacy Protection Law Amendment 13
Kenya Data Protection Act
Saudi PDPL
South Africa POPIA
UAE PDPLQuestions about Nigeria NDPA
- What are the Nigeria NDPA compliance deadlines?
- Jun 12, 2023: NDPA signed into law. Sep 19, 2025: GAID 2025 takes effect.
- When does Nigeria NDPA take effect?
- Nigeria NDPA took effect on Jun 12, 2023.
- Who does Nigeria NDPA apply to?
- Controllers and processors domiciled or operating in Nigeria, or processing personal data of data subjects in Nigeria. 'Data controllers/processors of major importance' designated by NDPC thresholds (tiered by number of data subjects processed).
- What are the penalties under Nigeria NDPA?
- Data controllers/processors of major importance: higher of NGN 10 million or 2% of annual gross revenue in the preceding financial year; others: higher of NGN 2 million or 2% of annual gross revenue.