Nigeria. Comprehensive data protection. Guidelines
GAIDNigeria Data Protection Act General Application and Implementation Directive 2025 (GAID)
§1Summary
- Synopsis
Implementing directive under the NDPA that sets out detailed operational rules, replacing the NDPR 2019 regime. It specifies DCPMI registration tiers and fees, compliance audit returns, DPO qualifications, transfer instruments and other practical obligations.
- Key themes
- Unique features
Volume-based tiers: Ordinary High Level (200-999 data subjects in six months; NGN 10,000, annual renewal), Extra-High Level (1,000-4,999; NGN 100,000) and Ultra-High Level (5,000+; NGN 250,000), with some sectors assigned a tier regardless of volume. EHL/UHL entities file annual audit returns via a licensed Data Protection Compliance Organisation by 31 March; late filing adds a 50% surcharge.
- SaaS relevance
Most SaaS vendors with a meaningful Nigerian user base will cross the 5,000-subject UHL threshold and must register, appoint a DPO and file annual audited returns.
§2Obligations
- Extraterritorial
- Yes
- Breach notification
- NDPC within 72h; data subjects immediately if high risk
- DPO
- Conditional
- Cross-border transfers
- Adequacy, SCCs/BCRs and other approved transfer instruments, derogations
- Maximum penalty
- As NDPA (2% revenue or NGN 10m); 50% late-filing surcharge on CAR fees
§3Dates
- Key dates
- Adopted
- In force
- Issued by NDPC 2025-03-20; effective 2025-09-19; CAR filing deadline 31 March annually
§4Text and authority
- Text
- Authoritative text ndpc.gov.ng
- Authority
- Nigeria Data Protection Commission (NDPC)
§5Where it applies
- Domestic law of
- Nigeria
§6Sources and verification
- Verification
High confidence.