Data Protection Monitor
Global Privacy & Data Protection Intelligence

Nigeria (NG) · Module Detail

Nigeria: Regulator & Framework

← Full Nigeria overview Build report with Nigeria Request deeper dive

#

Core statute and implementing directive are in force and actively enforced (registration, DPIA review, fines), but several operational details (e.g., full subsidiary regulations, sectoral harmonisation) remain under active development, consistent with the JID's in_transition designation.

Primary frameworkNigeria Data Protection Act, 2023 (NDPA)
Supervisory authorityNigeria Data Protection Commission (NDPC)
Traffic-light rationale — AmberCore statute and implementing directive are in force and actively enforced (registration, DPIA review, fines), but several operational details (e.g., full subsidiary regulations, sectoral harmonisation) remain under active development, consistent with the JID's in_transition designation.

Sub-modules (5)

Regulator And AuthorityGreen

NDPC established under the NDPA as an independent statutory commission overseeing implementation.

Claims (1):

  • The NDPA established the Nigeria Data Protection Commission whose mandate is to oversee implementation of the NDP Act.

Act And InstrumentsGreen

NDPA 2023 is primary; GAID 2025 is the operative implementing directive, effective 19 Sept 2025, superseding NDPR 2019.

Claims (2):

  • The Federal Government of Nigeria signed the Nigeria Data Protection Act 2023 into law on 12 June 2023.
  • The NDPC published the General Application and Implementation Directive (GAID) of the NDPA in March 2025, which took effect 19 September 2025 and expressly replaced the Nigeria Data Protection Regulation 2019.

Material ScopeGreen

Act covers all sectors and all aspects of data privacy processing.

Claims (1):

  • The NDP Act covers all sectors and all aspects of data privacy, imposing a duty of care in respect of customers, employees, guests, visitors, and other data subjects.

Territorial ScopeGreen

Applies to domiciled/resident/operating entities in Nigeria and extraterritorially to processors of Nigeria-based data subjects' data.

Claims (1):

  • The NDP Act applies where the organisation is domiciled, resident, or operating in Nigeria, where processing occurs within Nigeria, or where a non-domiciled organisation processes personal data of a data subject in Nigeria.

Regulator Registration And FilingAmber

DCPMI registration mandatory, tiered (UHL/EHL/OHL), with annual Compliance Audit Return (CAR) filing obligations.

Claims (1):

  • Data controllers and data processors of major importance (DCPMI) must register with the NDPC, classified into Ultra-High, Extra-High and Ordinary-High Level tiers with corresponding registration fees.
Category narrative131 words

Nigeria's regime is anchored on the Nigeria Data Protection Act 2023 (NDPA), which established the Nigeria Data Protection Commission (NDPC) as a statutory independent authority, elevating the prior Nigeria Data Protection Regulation (NDPR 2019) — a lower-status regulatory instrument issued by NITDA — to a full comprehensive statute. The NDPC's General Application and Implementation Directive (GAID) 2025, published March 2025 and effective 19 September 2025, operationalises the Act and expressly supersedes the NDPR as the primary interpretive instrument. Material and territorial scope are broad: the Act applies to any entity domiciled, resident, or operating in Nigeria, to processing occurring within Nigeria, and extraterritorially to non-domiciled entities processing the data of Nigeria-based data subjects. Registration of Data Controllers/Processors of Major Importance (DCPMI) is mandatory and actively enforced via an online registration portal.

Sources and claims (6)
  1. ProbableNDPC — The NDPA established the Nigeria Data Protection Commission whose mandate is to oversee implementation of the NDP Act.observed
  2. ProbableNDPC — The Federal Government of Nigeria signed the Nigeria Data Protection Act 2023 into law on 12 June 2023.observed
  3. ProbableIAPP — The NDPC published the General Application and Implementation Directive (GAID) of the NDPA in March 2025, which took effect 19 September 2025 and expressly replaced the Nigeria Data Protection Regulation 2019.observed
  4. ProbableNDPC — The NDP Act covers all sectors and all aspects of data privacy, imposing a duty of care in respect of customers, employees, guests, visitors, and other data subjects.observed
  5. ProbableNDPC — The NDP Act applies where the organisation is domiciled, resident, or operating in Nigeria, where processing occurs within Nigeria, or where a non-domiciled organisation processes personal data of a data subject in Nigeria.observed
  6. ProbableNDPC — Data controllers and data processors of major importance (DCPMI) must register with the NDPC, classified into Ultra-High, Extra-High and Ordinary-High Level tiers with corresponding registration fees.observed