--- title: "Nigeria — Regulator & Framework | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/nigeria/regulator-and-framework/ source_html: /jurisdictions/nigeria/regulator-and-framework/index.html description: "Nigeria — Regulator & Framework: regulator_and_framework Regulator & Framework 5 sub-modules 6 claims Amber ▾ # Core statute and implementing directive are in force and actively enforced (registration, DPIA review" generated_at: 2026-10-25T04:46:50Z content_sha256: 4d958e0cab811f778dabe0dc76e97fc644adafb195daae42c64542e6c1ff0f08 generator: "fe-fleet/md-twin@1.0" --- # Nigeria — Regulator & Framework | Data Protection Monitor ### D1Regulator & Framework5 sub-modules6 claimsAmber▾# Core statute and implementing directive are in force and actively enforced (registration, DPIA review, fines), but several operational details (e.g., full subsidiary regulations, sectoral harmonisation) remain under active development, consistent with the JID's in_transition designation. Primary framework Nigeria Data Protection Act, 2023 (NDPA) Supervisory authority [Nigeria Data Protection Commission (NDPC)](https://ndpc.gov.ng/) Traffic-light rationale — Amber Core statute and implementing directive are in force and actively enforced (registration, DPIA review, fines), but several operational details (e.g., full subsidiary regulations, sectoral harmonisation) remain under active development, consistent with the JID's in_transition designation. #### Sub-modules (5) #### Regulator And AuthorityGreen NDPC established under the NDPA as an independent statutory commission overseeing implementation. Claims (1): - The NDPA established the Nigeria Data Protection Commission whose mandate is to oversee implementation of the NDP Act. #### Act And InstrumentsGreen NDPA 2023 is primary; GAID 2025 is the operative implementing directive, effective 19 Sept 2025, superseding NDPR 2019. Claims (2): - The Federal Government of Nigeria signed the Nigeria Data Protection Act 2023 into law on 12 June 2023. - The NDPC published the General Application and Implementation Directive (GAID) of the NDPA in March 2025, which took effect 19 September 2025 and expressly replaced the Nigeria Data Protection Regulation 2019. #### Material ScopeGreen Act covers all sectors and all aspects of data privacy processing. Claims (1): - The NDP Act covers all sectors and all aspects of data privacy, imposing a duty of care in respect of customers, employees, guests, visitors, and other data subjects. #### Territorial ScopeGreen Applies to domiciled/resident/operating entities in Nigeria and extraterritorially to processors of Nigeria-based data subjects' data. Claims (1): - The NDP Act applies where the organisation is domiciled, resident, or operating in Nigeria, where processing occurs within Nigeria, or where a non-domiciled organisation processes personal data of a data subject in Nigeria. #### Regulator Registration And FilingAmber DCPMI registration mandatory, tiered (UHL/EHL/OHL), with annual Compliance Audit Return (CAR) filing obligations. Claims (1): - Data controllers and data processors of major importance (DCPMI) must register with the NDPC, classified into Ultra-High, Extra-High and Ordinary-High Level tiers with corresponding registration fees. Category narrative 131 words Nigeria's regime is anchored on the Nigeria Data Protection Act 2023 (NDPA), which established the Nigeria Data Protection Commission (NDPC) as a statutory independent authority, elevating the prior Nigeria Data Protection Regulation (NDPR 2019) — a lower-status regulatory instrument issued by NITDA — to a full comprehensive statute. The NDPC's General Application and Implementation Directive (GAID) 2025, published March 2025 and effective 19 September 2025, operationalises the Act and expressly supersedes the NDPR as the primary interpretive instrument. Material and territorial scope are broad: the Act applies to any entity domiciled, resident, or operating in Nigeria, to processing occurring within Nigeria, and extraterritorially to non-domiciled entities processing the data of Nigeria-based data subjects. Registration of Data Controllers/Processors of Major Importance (DCPMI) is mandatory and actively enforced via an online registration portal. Evidence 6 Sources and claims (6) - Probable[NDPC](https://ndpc.gov.ng/about-us/) — The NDPA established the Nigeria Data Protection Commission whose mandate is to oversee implementation of the NDP Act.observed 2026-08-07 - Probable[NDPC](https://ndpc.gov.ng/about-us/) — The Federal Government of Nigeria signed the Nigeria Data Protection Act 2023 into law on 12 June 2023.observed 2026-08-07 - Probable[IAPP](https://iapp.org/news/a/from-principles-to-practice-operationalizing-nigerias-data-protection-act-through-the-gaid) — The NDPC published the General Application and Implementation Directive (GAID) of the NDPA in March 2025, which took effect 19 September 2025 and expressly replaced the Nigeria Data Protection Regulation 2019.observed 2026-08-07 - Probable[NDPC](https://ndpc.gov.ng/faqs/) — The NDP Act covers all sectors and all aspects of data privacy, imposing a duty of care in respect of customers, employees, guests, visitors, and other data subjects.observed 2026-08-07 - Probable[NDPC](https://ndpc.gov.ng/faqs/) — The NDP Act applies where the organisation is domiciled, resident, or operating in Nigeria, where processing occurs within Nigeria, or where a non-domiciled organisation processes personal data of a data subject in Nigeria.observed 2026-08-07 - Probable[NDPC](https://ndpc.gov.ng/wp-content/uploads/2025/07/Updated-Guidance-Notice-on-Registtration-2024.pdf) — Data controllers and data processors of major importance (DCPMI) must register with the NDPC, classified into Ultra-High, Extra-High and Ordinary-High Level tiers with corresponding registration fees.observed 2026-08-07