#
Financial and telecoms sector overlays are confirmed and actively enforced; health, education, credit-scoring and insurance sector overlays are unconfirmed from available sources.
Sub-modules (7)
Financial Sector OverlayAmber
CBN Consumer Protection Regulation (Art. 5.4) and CBN risk-based cybersecurity framework (2022) apply alongside NDPA to financial institutions; NDPC has fined a major bank for data breach.
Claims (3):
- NDPC recognises the Central Bank of Nigeria's Consumer Protection Regulation (Article 5.4) as a complementary instrument alongside the NDPA.
- The Central Bank of Nigeria issued a risk-based cybersecurity framework and guidelines for other financial institutions on 29 June 2022, covering cybersecurity oversight, risk management and reporting.
- NDPC fined Fidelity Bank NGN 555.8 million for data protection violations, evidencing active enforcement against financial-sector data controllers.
Health Sector OverlayRed
No confirmed health-sector-specific data protection overlay was located for NG.
Telecoms And EprivacyAmber
NCC's Consumer Code of Practice Regulations (Part IV) is referenced by NDPC as a complementary instrument for telecoms-sector personal data.
Claims (1):
- NDPC recognises Part IV of the Nigerian Communications Commission's Consumer Code of Practice Regulations as a complementary instrument to the NDPA.
Employment DataRed
No confirmed employment-specific data protection overlay was located for NG.
Credit And ScoringRed
No confirmed credit-scoring-specific data protection overlay was located for NG.
EducationRed
No confirmed statutory education-sector data protection overlay was located; NDPC has pursued voluntary partnerships with universities.
InsuranceRed
No confirmed insurance-sector-specific data protection overlay was located for NG.
Sectoral Watch
Two recent NDPC actions illustrate active regulatory engagement with sector-specific data practices. In the financial sector, NDPC has opened an investigation into Remita Payment Services Ltd. and Sterling Bank following reports of a suspected cyberattack and claims of exposed sensitive customer and institutional data circulating on dark-web forums. In the media sector, NDPC fined MultiChoice Nigeria N766,242,500 for unlawful cross-border transfer of Nigerians' personal data and violation of subscribers' and non-subscribers' privacy rights, following an investigation opened in the second quarter of 2024. Taken together, these two actions, in payments and broadcasting respectively, indicate that NDPC's sectoral attention is not confined to a single industry but is being applied wherever cross-border transfer or breach exposure arises, regardless of sector.
Outlook
Whether NDPC's sectoral attention extends further, to other financial-sector processors or other media and telecommunications entities handling comparable volumes of subscriber data, is the key signal to watch as the Remita/Sterling Bank investigation develops.
1 earlier distinct update(s)
Sectoral Watch
The financial-services sector in Nigeria now carries a distinct data-localisation obligation layered on top of the general Nigeria Data Protection Act framework. The Central Bank of Nigeria issued Circular PSS/DIR/PUB/CIR/001/004 on 15 June 2026, signed by Rakiya O. Yusuf, directing that all payment-transaction data generated within Nigeria be stored and managed within Nigeria, and that this storage be conducted in accordance with data protection laws. The circular sets full compliance by 1 January 2027, placing it in enacted-but-not-yet-effective status at the time of this cycle: payment firms are on notice of the obligation but have a defined compliance runway before it takes legal effect.
This is a sectoral overlay rather than a general NDPA requirement, and its significance lies in the precedent it sets for sector-specific regulators layering data-residency requirements on top of the Act's general, technology-and-sector-neutral framework. The NDPA itself does not impose a blanket data-localisation requirement; its cross-border transfer provisions instead apply an adequacy-and-safeguards test to international transfers generally. The CBN circular's requirement that in-country storage be conducted in accordance with data protection laws suggests the Central Bank intends compliance with its localisation mandate to be read alongside, rather than as a substitute for, the Nigeria Data Protection Commission's existing framework, though the precise mechanics of how the two regimes interact — for instance whether a payment firm's NDPA-compliant cross-border transfer of transaction data would nonetheless breach the CBN circular — were not resolved in material reviewed this cycle.
The obligation's addressee is explicitly the payment firm sector, and its 1 January 2027 effective date gives the sector roughly six and a half months from the circular's issuance to localise data-storage infrastructure. Given the materiality that this monitor assigns to sectoral financial-data requirements, this circular should be treated as a standing compliance deadline for payment firms operating in Nigeria, distinct from and additional to their general NDPA obligations.
Outlook
The period leading up to 1 January 2027 is the operative window in which payment firms must complete data-localisation compliance under Circular PSS/DIR/PUB/CIR/001/004. Whether the Central Bank or the National Data Protection Commission issues further joint or clarifying guidance on how the localisation mandate interacts with the NDPA's cross-border transfer regime is the principal open question carrying into subsequent cycles; absent such guidance, payment firms are left to reconcile the two regimes without explicit regulatory direction.
1 further periodic run re-emitted the standing brief unchanged and is not shown.
Sources and claims (4)
- ProbableNDPC — NDPC recognises the Central Bank of Nigeria's Consumer Protection Regulation (Article 5.4) as a complementary instrument alongside the NDPA.observed
- ProbableOneTrust DataGuidance — The Central Bank of Nigeria issued a risk-based cybersecurity framework and guidelines for other financial institutions on 29 June 2022, covering cybersecurity oversight, risk management and reporting.observed
- ProbableOneTrust DataGuidance — NDPC fined Fidelity Bank NGN 555.8 million for data protection violations, evidencing active enforcement against financial-sector data controllers.observed
- ProbableNDPC — NDPC recognises Part IV of the Nigerian Communications Commission's Consumer Code of Practice Regulations as a complementary instrument to the NDPA.observed