Privacy Map

Africa. National jurisdiction.

Nigeria NG

Primary authority: Nigeria Data Protection Commission (NDPC)
Part I

Domestic law

Comprehensive data protection2

  • GAIDNigeria Data Protection Act General Application and Implementation Directive 2025 (GAID)In force
    In force from     Implementing directive under the NDPA that sets out detailed operational rules, replacing the NDPR 2019 regime. It specifies DCPMI registration tiers and fees, compliance audit returns, DPO qualifications, transfer instruments and other practical obligations.
    Synopsis

    Implementing directive under the NDPA that sets out detailed operational rules, replacing the NDPR 2019 regime. It specifies DCPMI registration tiers and fees, compliance audit returns, DPO qualifications, transfer instruments and other practical obligations.

    Key themes
    • DCPMI registration tiers
    • compliance audit returns
    • DPO
    • DPIA
    • cross-border transfer instruments
    • legitimate interest
    • children's data
    Unique features

    Volume-based tiers: Ordinary High Level (200-999 data subjects in six months; NGN 10,000, annual renewal), Extra-High Level (1,000-4,999; NGN 100,000) and Ultra-High Level (5,000+; NGN 250,000), with some sectors assigned a tier regardless of volume. EHL/UHL entities file annual audit returns via a licensed Data Protection Compliance Organisation by 31 March; late filing adds a 50% surcharge.

    SaaS relevance

    Most SaaS vendors with a meaningful Nigerian user base will cross the 5,000-subject UHL threshold and must register, appoint a DPO and file annual audited returns.

    Extraterritorial
    Yes
    Breach notification
    NDPC within 72h; data subjects immediately if high risk
    DPO
    Conditional
    Cross-border transfers
    Adequacy, SCCs/BCRs and other approved transfer instruments, derogations
    Maximum penalty
    As NDPA (2% revenue or NGN 10m); 50% late-filing surcharge on CAR fees
    Key dates
    • Adopted
    • In force
    • Issued by NDPC 2025-03-20; effective 2025-09-19; CAR filing deadline 31 March annually
    Text
    Authority
    Nigeria Data Protection Commission (NDPC)
    Verification

    High confidence.

    Full record for GAID
  • NDPANigeria Data Protection Act 2023 (NDPA)In force
    In force from     Nigeria's primary data protection statute, establishing the NDPC and GDPR-style principles, lawful bases, rights and controller obligations. It applies to controllers and processors domiciled, resident or operating in Nigeria, including those targeting Nigerian data subjects.
    Synopsis

    Nigeria's primary data protection statute, establishing the NDPC and GDPR-style principles, lawful bases, rights and controller obligations. It applies to controllers and processors domiciled, resident or operating in Nigeria, including those targeting Nigerian data subjects.

    Key themes
    • lawful bases
    • data subject rights
    • DPIA
    • DPO
    • breach notification
    • data controllers/processors of major importance
    • cross-border transfers
    Unique features

    Data controllers and processors 'of major importance' (DCPMI) must register with the NDPC and, under the GAID, pay tiered fees and file annual Compliance Audit Returns through licensed DPCOs. Turnover-based fines distinguish major-importance entities (higher floor).

    SaaS relevance

    A foreign SaaS provider that targets Nigerian users is 'operating in Nigeria' and, if it meets the major-importance thresholds or sector designations (e.g. fintech, telecoms), must register with the NDPC.

    Extraterritorial
    Yes
    Breach notification
    NDPC within 72h; data subjects immediately if high risk
    DPO
    Conditional
    Cross-border transfers
    Adequacy (NDPC), SCCs/BCRs/codes/certification, derogations
    Maximum penalty
    Greater of NGN 10m or 2% of prior-year gross revenue (major importance); NGN 2m or 2% otherwise
    Key dates
    • Adopted
    • In force
    • Presidential assent June 2023; GAID 2025 issued 2025-03-20, effective 2025-09-19; replaced NDPR 2019 and its 2020 Implementation Framework
    Text
    Authority
    Nigeria Data Protection Commission (NDPC)
    Sources consulted
    Verification

    High confidence.

    Sectoral localisation persists outside NDPA (e.g. NITDA ICT content guidelines for government data; CBN rules for some payment data) – not re-verified this session.

    Full record for NDPA
Part II

Regional & international frameworks

Membership-based — check ratification status in the instrument record. 9 instruments from 4 bodies.

African Union

  • Malabo ConventionAfrican Union Convention on Cyber Security and Personal Data Protection (Malabo Convention)In force
    In force from     A pan-African treaty covering electronic transactions, personal data protection and cybersecurity and cybercrime. Parties must adopt data protection laws with GDPR-like principles, independent national authorities and data subject rights, and must criminalise cyber offences.
    Synopsis

    A pan-African treaty covering electronic transactions, personal data protection and cybersecurity and cybercrime. Parties must adopt data protection laws with GDPR-like principles, independent national authorities and data subject rights, and must criminalise cyber offences.

    Key themes
    • data protection principles
    • independent DPA
    • data subject rights
    • sensitive data
    • e-transactions
    • cybercrime
    Unique features

    It is the only binding pan-African data protection treaty, but few states have ratified it. It contains transfer restrictions to non-member states without adequate protection.

    SaaS relevance

    It does not directly bind companies; it underpins national laws in ratifying states.

    Cross-border transfers
    Transfers to non-AU states only with adequate protection
    Maximum penalty
    Set by national law
    Key dates
    • Adopted
    • In force
    • Adopted in Malabo in June 2014; entered into force 2023-06-08, 30 days after the 15th ratification (Mauritania); 16 ratifications recorded as of mid-2024
    Text
    Authority
    National data protection authorities (to be set up by each party); AU Commission
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. I could not get the current ratification count from the AU treaty status list; 16 was the figure as of mid-2024. The exact adoption date (27 June 2014) comes from established references.

    Full record for Malabo Convention
    Partly verifiedMedium confidence. I could not get the current ratification count from the AU treaty status list; 16 was the figure as of mid-2024. The exact adoption date (27 June 2014) comes from established references.
  • AU Data Policy FrameworkAfrican Union Data Policy FrameworkIn force
    In force from     A non-binding policy framework to help AU member states build national data systems. It promotes data protection, cross-border data flows within Africa, data infrastructure and a single African digital market. Member states are encouraged to adopt data protection laws and ratify the Malabo Convention.
    Synopsis

    A non-binding policy framework to help AU member states build national data systems. It promotes data protection, cross-border data flows within Africa, data infrastructure and a single African digital market. Member states are encouraged to adopt data protection laws and ratify the Malabo Convention.

    Key themes
    • data governance
    • intra-African data flows
    • data protection
    • data sovereignty
    • digital single market
    • AfCFTA
    Unique features

    It links data governance to the African Continental Free Trade Area, and favours free flow of data within Africa over localisation.

    SaaS relevance

    Soft law; it signals the direction of national data regimes and AfCFTA digital trade rules affecting SaaS in Africa.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    Promotes intra-African free flow with safeguards
    Maximum penalty
    None
    Key dates
    • Adopted
    • In force
    • Endorsed by the AU Executive Council in February 2022; published July 2022
    Text
    Authority
    AU Commission
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. No verification notes recorded.

    Full record for AU Data Policy Framework
    Partly verifiedMedium confidence. No verification notes recorded.

Commonwealth of Nations

  • Commonwealth Model LawCommonwealth Model Provisions on Data Protection (2022), replacing the Model Bill on the Protection of Personal Information (2002) and Model Privacy BillIn force
    In force from     A non-binding template law that Commonwealth member states can adapt when drafting or amending data protection legislation. It includes optional provisions on consent, use limitation, breach investigation, compliance and cross-border transfers, and aims to harmonise rules across the 56 Commonwealth countries.
    Synopsis

    A non-binding template law that Commonwealth member states can adapt when drafting or amending data protection legislation. It includes optional provisions on consent, use limitation, breach investigation, compliance and cross-border transfers, and aims to harmonise rules across the 56 Commonwealth countries.

    Key themes
    • model legislation
    • consent
    • breach handling
    • cross-border transfers
    • harmonisation
    Unique features

    Offers optional drafting alternatives to fit common-law systems at different development stages; it is aligned with recent international instruments.

    SaaS relevance

    Background only; influences national laws in smaller Commonwealth jurisdictions.

    Breach notification
    Model provisions on breach investigation
    Cross-border transfers
    Model grounds for cross-border transfer
    Maximum penalty
    None (model)
    Key dates
    • Adopted
    • In force
    • 2002 Model Bill on the Protection of Personal Information and Model Privacy Bill; replaced by the Model Provisions on Data Protection adopted by Commonwealth Law Ministers in Mauritius in November 2022
    Text
    Authority
    Commonwealth Secretariat (Rule of Law)
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. The text_url is the announcement page; I did not find a direct link to the model law text.

    Full record for Commonwealth Model Law
    Partly verifiedMedium confidence. The text_url is the announcement page; I did not find a direct link to the model law text.

Economic Community of West African States (ECOWAS)

  • ECOWAS Supplementary ActSupplementary Act A/SA.1/01/10 on Personal Data Protection within ECOWASIn force
    In force from     Requires ECOWAS member states to adopt data protection laws based on common principles: consent and legitimacy, purpose, proportionality, accuracy, transparency, confidentiality and security. It also requires independent national DPAs, data subject rights and restrictions on transfers outside ECOWAS.
    Synopsis

    Requires ECOWAS member states to adopt data protection laws based on common principles: consent and legitimacy, purpose, proportionality, accuracy, transparency, confidentiality and security. It also requires independent national DPAs, data subject rights and restrictions on transfers outside ECOWAS.

    Key themes
    • principles
    • independent DPA
    • prior formalities
    • data subject rights
    • transfers outside ECOWAS
    Unique features

    It is binding community law that annexes to the ECOWAS Treaty. Its French-style prior declaration and authorisation formalities show up in many West African national laws.

    SaaS relevance

    It shapes national registration and transfer requirements that SaaS providers meet in West African markets.

    Cross-border transfers
    Transfers outside ECOWAS only to adequate countries
    Maximum penalty
    Set by national law
    Key dates
    • Adopted
    • In force
    • Adopted in Abuja on 2010-02-16; a revision was under consultation in late 2024
    Text
    Authority
    National data protection authorities of ECOWAS member states
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. The Statewatch copy is unofficial. The revision status is unclear; a 2024 consultation existed and I found no adopted revision.

    Full record for ECOWAS Supplementary Act
    Partly verifiedMedium confidence. The Statewatch copy is unofficial. The revision status is unclear; a 2024 consultation existed and I found no adopted revision.

United Nations

  • UN Cybercrime ConventionUnited Nations Convention against Cybercrime; Strengthening International Cooperation for Combating Certain Crimes Committed by Means of Information and Communications Technology Systems and for the Sharing of Evidence in Electronic Form of Serious CrimesSigned – not ratified
    The first global UN treaty on cybercrime. It requires states to criminalise a set of computer-related offences and to provide procedural powers, such as preserving and producing stored data and collecting traffic and content data, and it sets up channels for cross-border e-evidence cooperation on serious crimes. It includes a general human rights clause and conditions and safeguards on these powers.
    Synopsis

    The first global UN treaty on cybercrime. It requires states to criminalise a set of computer-related offences and to provide procedural powers, such as preserving and producing stored data and collecting traffic and content data, and it sets up channels for cross-border e-evidence cooperation on serious crimes. It includes a general human rights clause and conditions and safeguards on these powers.

    Key themes
    • cybercrime offences
    • e-evidence
    • production orders
    • data preservation
    • mutual legal assistance
    • human rights safeguards
    Unique features

    It is broader than the Budapest Convention in that evidence sharing covers any 'serious crime'. Rights groups and industry have criticised its safeguards as weak.

    SaaS relevance

    Once in force and implemented, it could widen the range of states able to issue preservation and production orders to cloud and SaaS providers.

    Extraterritorial
    Limited
    Breach notification
    None
    DPO
    No
    Cross-border transfers
    Cooperation channels for electronic evidence
    Maximum penalty
    Set by national law
    Key dates
    • Adopted
    • Adopted by the UN General Assembly in December 2024; opened for signature in Hanoi on 2025-10-25; enters into force 90 days after the 40th ratification. About 3 ratifications (Qatar, Azerbaijan, Viet Nam) as of mid-2026.
    Text
    Authority
    UNODC (secretariat); Conference of the States Parties once in force
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. The ratification count comes from secondary sources as of mid-2026. The convention is not in force (it needs 40 ratifications). The exact GA adoption date (24 Dec 2024, A/RES/79/243) comes from established references and I did not re-verify it.

    Full record for UN Cybercrime Convention
    Partly verifiedMedium confidence. The ratification count comes from secondary sources as of mid-2026. The convention is not in force (it needs 40 ratifications). The exact GA adoption date (24 Dec 2024, A/RES/79/243) comes from established references and I did not re-verify it.
  • Right to privacy in the digital ageUN General Assembly resolutions on the right to privacy in the digital age (series)In force
    In force from     This is a recurring series of non-binding General Assembly resolutions. They confirm that people have the same privacy rights online as offline, and they ask states to review surveillance, interception and bulk data collection against international human rights law. Later resolutions also cover AI, biometrics, encryption and data brokers.
    Synopsis

    This is a recurring series of non-binding General Assembly resolutions. They confirm that people have the same privacy rights online as offline, and they ask states to review surveillance, interception and bulk data collection against international human rights law. Later resolutions also cover AI, biometrics, encryption and data brokers.

    Key themes
    • surveillance
    • interception
    • AI and privacy
    • encryption
    • business responsibility
    • remedies
    Unique features

    The series grew out of the 2013 Snowden revelations. It led to OHCHR reports and, through the Human Rights Council, to the Special Rapporteur on privacy.

    SaaS relevance

    These are soft-law expectations on business respect for privacy (UN Guiding Principles), which are relevant to transparency reporting and to how a provider handles government data requests.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    None
    Maximum penalty
    None
    Key dates
    • Adopted
    • In force
    • First resolution A/RES/68/167 (2013-12-18); renewed roughly every two years; latest verified A/RES/79/175 adopted 2024-12-17
    Text
    Authority
    Office of the UN High Commissioner for Human Rights (OHCHR) reports; UN Special Rapporteur on the right to privacy
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. Treated as one row for the whole series. I did not check whether a newer resolution was adopted at the 80th session in late 2025.

    Full record for Right to privacy in the digital age
    Partly verifiedMedium confidence. Treated as one row for the whole series. I did not check whether a newer resolution was adopted at the 80th session in late 2025.
  • ICCPR Art 17International Covenant on Civil and Political Rights, Article 17In force
    In force from     This is a binding treaty. Article 17 bans arbitrary or unlawful interference with privacy, family, home or correspondence, and requires states parties to protect people from such interference by law. The Human Rights Committee monitors compliance through state reports and, for states that accept it, individual complaints.
    Synopsis

    This is a binding treaty. Article 17 bans arbitrary or unlawful interference with privacy, family, home or correspondence, and requires states parties to protect people from such interference by law. The Human Rights Committee monitors compliance through state reports and, for states that accept it, individual complaints.

    Key themes
    • right to privacy
    • state obligations
    • legality
    • arbitrariness
    • individual communications
    Unique features

    It is the main binding global privacy guarantee and has about 170+ parties. General Comment 16 reads it as covering the gathering and holding of personal information, including by private bodies.

    SaaS relevance

    It binds states, not companies, but it shapes national privacy laws and the rules on government access to the data SaaS providers hold.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    None
    Maximum penalty
    None (treaty-body views; no fines)
    Key dates
    • Adopted
    • In force
    • Adopted by GA resolution 2200A (XXI) on 1966-12-16; in force 1976-03-23. Human Rights Committee General Comment No. 16 on Article 17 was issued in 1988.
    Text
    Authority
    UN Human Rights Committee (treaty body)
    Sources consulted
    Verification

    High confidence.

    The party count is approximate and was not re-checked against the UN Treaty Collection.

    Full record for ICCPR Art 17
  • UDHR Art 12Universal Declaration of Human Rights, Article 12In force
    In force from     Article 12 says no one may be subjected to arbitrary interference with their privacy, family, home or correspondence, and that everyone is entitled to legal protection against such interference. It is a declaration rather than a treaty, but it is the starting point for privacy as an international human right.
    Synopsis

    Article 12 says no one may be subjected to arbitrary interference with their privacy, family, home or correspondence, and that everyone is entitled to legal protection against such interference. It is a declaration rather than a treaty, but it is the starting point for privacy as an international human right.

    Key themes
    • right to privacy
    • correspondence
    • reputation
    • protection of the law
    Unique features

    Not legally binding in itself, though many of its provisions are treated as customary international law. Every later privacy instrument, from the ECHR to the ICCPR, builds on this text.

    SaaS relevance

    Gives no direct obligations to a SaaS business; it is useful as the human rights background for policies and DPIAs.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    None
    Maximum penalty
    None
    Key dates
    • Adopted
    • In force
    • Proclaimed by the UN General Assembly in Paris on 10 December 1948
    Text
    Authority
    None designated
    Sources consulted
    Verification

    High confidence.

    The CIPP/E project holds a copy (1948UDHR.pdf).

    Full record for UDHR Art 12
  • UN Guidelines 1990Guidelines for the Regulation of Computerized Personal Data FilesIn force
    In force from     Non-binding guidelines from the General Assembly that set minimum guarantees for national laws on computerised personal data files, covering both public and private files. They list principles such as lawfulness and fairness, accuracy, purpose specification, interested-person access, non-discrimination, security and independent supervision.
    Synopsis

    Non-binding guidelines from the General Assembly that set minimum guarantees for national laws on computerised personal data files, covering both public and private files. They list principles such as lawfulness and fairness, accuracy, purpose specification, interested-person access, non-discrimination, security and independent supervision.

    Key themes
    • fair information principles
    • sensitive data
    • access
    • security
    • supervisory authority
    • transborder flows
    Unique features

    Separate provisions extend the principles to files held by international governmental organisations. They also have an early non-discrimination rule on sensitive data and allow transfers to countries with comparable safeguards.

    SaaS relevance

    Gives no direct obligations; it is historical background to UN-system data protection policies.

    Breach notification
    None
    DPO
    No
    Cross-border transfers
    Free flow to states with comparable safeguards
    Maximum penalty
    None
    Key dates
    • Adopted
    • In force
    Text
    Authority
    None designated
    Sources consulted
    Verification

    Medium confidence.

    Partly verifiedMedium confidence. I did not open the resolution text in this session. The resolution number and date come from established references. Refworld is a UNHCR mirror; the official text is in the UN Digital Library under A/RES/45/95.

    Full record for UN Guidelines 1990
    Partly verifiedMedium confidence. I did not open the resolution text in this session. The resolution number and date come from established references. Refworld is a UNHCR mirror; the official text is in the UN Digital Library under A/RES/45/95.