Nigeria. Comprehensive data protection. Act
NDPANigeria Data Protection Act 2023 (NDPA)
§1Summary
- Synopsis
Nigeria's primary data protection statute, establishing the NDPC and GDPR-style principles, lawful bases, rights and controller obligations. It applies to controllers and processors domiciled, resident or operating in Nigeria, including those targeting Nigerian data subjects.
- Key themes
- Unique features
Data controllers and processors 'of major importance' (DCPMI) must register with the NDPC and, under the GAID, pay tiered fees and file annual Compliance Audit Returns through licensed DPCOs. Turnover-based fines distinguish major-importance entities (higher floor).
- SaaS relevance
A foreign SaaS provider that targets Nigerian users is 'operating in Nigeria' and, if it meets the major-importance thresholds or sector designations (e.g. fintech, telecoms), must register with the NDPC.
§2Obligations
- Extraterritorial
- Yes
- Breach notification
- NDPC within 72h; data subjects immediately if high risk
- DPO
- Conditional
- Cross-border transfers
- Adequacy (NDPC), SCCs/BCRs/codes/certification, derogations
- Maximum penalty
- Greater of NGN 10m or 2% of prior-year gross revenue (major importance); NGN 2m or 2% otherwise
§3Dates
- Key dates
- Adopted
- In force
- Presidential assent June 2023; GAID 2025 issued 2025-03-20, effective 2025-09-19; replaced NDPR 2019 and its 2020 Implementation Framework
§4Text and authority
- Text
- Authoritative text ndpc.gov.ng
- Authority
- Nigeria Data Protection Commission (NDPC)
§5Where it applies
- Domestic law of
- Nigeria
§6Sources and verification
- Sources consulted
- Verification
High confidence.
Sectoral localisation persists outside NDPA (e.g. NITDA ICT content guidelines for government data; CBN rules for some payment data) – not re-verified this session.