Nigeria now runs on a two-layer data protection regime, the Nigeria Data Protection Act 2023 (NDPA) and the Nigeria Data Protection Commission's General Application and Implementation Directive (GAID), and the GAID turns the Act's principles into hard deliverables: registration, annual audit returns filed through licensed auditors, DPIAs filed before processing, and a 72-hour breach clock. The GAID was issued on 20 March 2025, became fully effective on 19 September 2025, and repealed the Nigeria Data Protection Regulation 2019 and its 2020 Implementation Framework, so policies written for the NDPR need rework. This guide covers scope, the obligations security teams own, the registration and Compliance Audit Return (CAR) cycle, breach notification, transfers, enforcement and what the regime means for AI agents and machine credentials. It is written for security, privacy and engineering leads at organisations that process personal data of people in Nigeria, whether or not they are based there.
Key takeaways
- The Act reaches foreign organisations: section 2 applies to controllers and processors that are not in Nigeria but process personal data of data subjects in Nigeria.
- 72 hours is the regulator clock: section 40(2) and GAID Article 33 require notice to the Commission within 72 hours of becoming aware of a breach likely to result in a risk to rights, and data subjects must be told immediately where the risk is high.
- "Major importance" drives most of the paperwork: data controllers and processors of major importance (DCPMIs) register with the Commission, appoint a DPO and, in the Ultra-High and Extra-High levels, file a CAR through a licensed Data Protection Compliance Organisation (DPCO) by 31 March each year.
- Security evidence must be certified: GAID Article 29 requires a schedule for monitoring, evaluating and maintaining data security, vetted and certified by a certified information security officer.
- Enforcement is real and growing: the Commission fined Fidelity Bank N555.8 million (2024) and MultiChoice Nigeria about N766 million (2025), the latter including unlawful cross-border transfers.
Scope: who and what is covered
The NDPA was signed into law on 12 June 2023. It established the Nigeria Data Protection Commission (NDPC) as the regulator and applies to processing by automated means or not (section 2(1)) where the controller or processor is domiciled, resident or operating in Nigeria, the processing occurs in Nigeria, or a controller outside Nigeria processes personal data of a data subject in Nigeria (section 2(2)). The GAID applies on top of the Act and is the instrument the Commission audits against.
| Element | NDPA / GAID position | Reference |
|---|---|---|
| Data controller | Determines purposes and means of processing, alone or jointly | NDPA definitions |
| Data processor | Processes on behalf of, or at the direction of, a controller under a written agreement | NDPA s29; GAID Art 34 |
| Controller or processor of major importance | Domiciled, resident or operating in Nigeria and processing data of more than a number of data subjects the Commission prescribes, or in a class the Commission designates as of particular value or significance | NDPA s65; GAID Art 8 |
| Levels of major importance | Ultra-High Level (UHL), Extra-High Level (EHL), Ordinary-High Level (OHL) | GAID Art 8(4), Schedule 7 |
| Sensitive personal data | Additional conditions apply; processing of sensitive data is one of the triggers for a mandatory DPIA | NDPA Part V; GAID Art 28(3) |
| Exclusions | Purely personal or household processing that does not violate privacy, plus limited carve-outs (for example criminal investigation, national security, journalism, legal claims) that still require security safeguards | NDPA (exemptions) |
UHL and EHL in practice: commentary on the GAID places commercial banks, telecoms operators, insurers, multinationals, payment providers and fintechs in UHL, and government ministries and agencies, microfinance and mortgage banks, tertiary institutions and larger hospitals in EHL, alongside data-subject volume tests. Confirm your level against the Schedule 7 guidance notice.
Key obligations
Principles and lawful bases
Section 24 sets six principles (fair, lawful and transparent processing; specified purposes; minimisation; limited retention; accuracy; and security against unauthorised processing, loss or destruction) and section 24(2) requires technical and organisational measures to deliver them. Section 25 lists the lawful bases: consent, contract, legal obligation, vital interests, public interest or official authority, and legitimate interests. Consent cannot be inferred from silence or inactivity (section 26). Where you rely on legitimate interest, GAID Article 26 requires a legitimate interest assessment on the Schedule 8 template before processing starts and expects you to show the basis in the compliance audit.
Security: section 39 and GAID Article 29
- Measures: section 39 requires appropriate technical and organisational measures for security, integrity and confidentiality, with examples such as pseudonymisation, encryption, risk assessment and regular security testing.
- Security schedule: GAID Article 29 requires a documented schedule for monitoring, evaluating and maintaining data security covering training, certifications, software updates, database vulnerability testing, hardware assessment, authentication checks, encryption reviews and quality assurance. Article 29(4) requires it to be vetted and certified by a certified information security officer, and Article 29(5) expects monitoring as frequently as the processing risk warrants.
- Devices: GAID Article 10(5) expects online devices that access personal data to be audited as frequently as possible.
Data protection impact assessments
Section 28 requires a DPIA before processing likely to result in high risk, with prior consultation of the Commission where the risk remains. GAID Article 28(3) goes further: a DPIA is mandatory and must be filed with the Commission in listed circumstances (items a to o), including profiling, automated decisions with significant effects, systematic monitoring, sensitive data, vulnerable data subjects, innovative technologies and cross-border transfers. Article 28(9) requires submission before processing begins, Article 28(4) and (12) require vetting and signature by an accredited DPO, and Article 28(6) warns that failure can lead to a restriction on the platforms through which data subjects interact with you. See the DPIA Guide: Running a Data Protection Impact Assessment.
Processors and contracts
Section 29 requires controllers to flow down their obligations to processors through a written agreement. GAID Article 34(2) lists what the data processing agreement must state, including purpose, location of processing (with cross-border rules in mind), lawful bases, the DPIA outcome, confidentiality, tenure, indemnity and insurance. Article 34(3) keeps the controller accountable for the third parties it engages. The Fidelity Bank decision cited engaging non-compliant third-party processors, so supplier evidence matters. See the Third-Party Risk Management Guide.
Breach notification: section 40 and GAID Article 33
| Element | Rule | Reference |
|---|---|---|
| Processor to controller | Notify the controller promptly on becoming aware of a breach, and assist with the controller's obligations | NDPA s40(1) |
| Controller to Commission | Within 72 hours of becoming aware of a breach likely to result in a risk to the rights and freedoms of individuals | NDPA s40(2); GAID Art 7(p), 33(1) |
| Controller to data subjects | Immediately, in plain language, where the breach is likely to result in a high risk | NDPA s40(3); GAID Art 7(q), 33(3) |
| What counts as high risk | Includes possible fraud, identity theft and exposure of sensitive data | GAID Art 33(2) |
| Content of the notice | Circumstances, dates, personal data involved, risk assessment, estimated number affected, mitigation, notification steps taken, contact person | NDPA s40(4); GAID Art 33(5) |
| National-scale incidents | Inform relevant authorities immediately where that could help contain the breach | GAID Art 33(4) |
| Breach record | Keep a record of all breaches, facts, effects and remedial action | NDPA s40(8) |
| Channel | The Commission's breach portal at services.ndpc.gov.ng/breach | NDPC website |
The clock starts at awareness, not confirmation. For how Nigeria compares with other countries' clocks, see the Breach Notification Laws by Country Guide. The Philippines also runs a 72-hour clock to its regulator, covered in our Philippines Data Privacy Act guide.
Cross-border transfers: Part VIII
Section 41 allows a transfer only where the recipient is subject to a law, binding corporate rules, contractual clauses, code of conduct or certification mechanism that gives an adequate level of protection, or where a section 43 basis applies, and the controller must record the basis and the adequacy of protection. Section 42 lets the Commission make adequacy determinations. Section 43 lists the fall-back bases: explicit consent after being informed of the risks, performance of a contract, public interest, legal claims and vital interests. GAID Article 45 confirms Part VIII is the governing provision and that, until the Commission issues a dedicated instrument, the Schedule 5 explanatory note guides adequacy and other grounds. Cross-border transfer also triggers a mandatory DPIA under GAID Article 28(3)(o). The MultiChoice fine shows the Commission tests transfers in practice. See the International Data Transfers Map.
Data subject rights and automated decisions
Sections 34 to 38 give rights of access, rectification, erasure, restriction, objection and portability, and section 37 protects against solely automated decisions with legal or similarly significant effects. GAID Article 7 adds a Standard Notice to Address Grievance (SNAG) redress mechanism.
Timeline and current status
| Date | Event |
|---|---|
| 2019 / 2020 | NDPR 2019 and the NDPR Implementation Framework 2020 (now repealed by the GAID) |
| 12 June 2023 | NDPA signed into law; NDPC established |
| 20 March 2025 | GAID issued by the Commission |
| 19 September 2025 | GAID fully effective |
| 31 March each year | CAR deadline for UHL and EHL entities, covering the previous year's processing (the 2026 filing covered 2025) |
| January 2026 | NDPC reported 38,677 registered DCPMIs, 307 licensed DPCOs and over 8,155 CARs filed |
Several GAID duties run from issuance, including a DPIA within six months for processing that began before the Act and the GAID took effect (Article 28(10)). The Commission states that the Schedule 5 transfer note applies until a dedicated transfer instrument is issued, so expect further secondary rules. Check ndpc.gov.ng for new guidance notices before each filing cycle.
Registration and the CAR cycle
| Level | Registration | Annual duty | CAR fee band (Schedule 10) |
|---|---|---|---|
| UHL | Register once (GAID Art 9(2)) | File CAR by 31 March through a licensed DPCO | N500,000 to N1,000,000 by data-subject tier |
| EHL | Register once | File CAR by 31 March through a licensed DPCO | N100,000 to N250,000 by tier |
| OHL | Renew registration annually (Art 9(3)) | No CAR at renewal | Not applicable |
- Six months to register: NDPA section 44(1) requires registration within six months of commencement or of becoming a DCPMI. Significant changes must be notified within 60 days (section 44(3); GAID Art 9(4)).
- First audit: every controller and processor completes a compliance audit within 15 months of commencing business, then annually (GAID Art 7(b), 10(8)).
- Late filing: an administrative penalty of 50% of the CAR filing fee (Art 10(9)).
- DPO duties: the DPO reports directly to management (Art 12(5)), cannot be penalised for doing the job (Art 12(4)), compiles a semi-annual data protection report (Art 13) and is subject to the Commission's annual credential assessment (Art 14(2)).
Enforcement and penalties
The Commission investigates complaints and may open inquiries on its own initiative (section 46). It can issue compliance orders (section 47) and enforcement orders (section 48), which may require remedies, compensation, accounting for profits and a penalty or remedial fee. Failing to comply with an order is an offence under section 49, punishable by a fine, up to one year's imprisonment, or both.
| Category | Maximum penalty | Reference |
|---|---|---|
| Controller or processor of major importance | The greater of N10,000,000 or 2% of annual gross revenue in the preceding financial year | NDPA s48 |
| Other controllers and processors | The greater of N2,000,000 or 2% of annual gross revenue in the preceding financial year | NDPA s48 |
| Late CAR | 50% of the filing fee | GAID Art 10(9) |
| Failure to conduct a DPIA | Possible restriction of platforms through which data subjects interact with the entity | GAID Art 28(6) |
- Fidelity Bank (2024): N555.8 million for processing without informed consent, non-transparent cookie use in banking apps, and engaging non-compliant third-party processors.
- MultiChoice Nigeria (July 2025): N766,242,500 after an investigation opened in 2024 found processing the Commission called intrusive, unfair, unnecessary and disproportionate, and unlawful cross-border transfer of Nigerians' data.
- Scale: in January 2026 the Commission reported 246 concluded investigations and 11 enforcement actions.
What it means for AI agents and non-human identities
The GAID is one of the few African instruments with an article on emerging technology. Article 43 applies to controllers and processors that deploy or plan to deploy AI, IoT or blockchain to process personal data. They must set and document technical and organisational parameters so the tools operate within lawful processing (covering automated decisions, erasure with synthetic data or tokenisation as alternatives, sensitive data, children and vulnerable groups, cross-border flows and privacy by design), file those parameters with the CAR, run a DPIA that assesses disparate outcomes, test in controlled low-risk environments and monitor continuously.
- Agents are processing operations: an AI agent that reads a CRM, summarises tickets or calls a payment API is a processing operation with a lawful basis, a purpose and a DPIA trigger (innovative technology, profiling or automated decisions). Record each agent, its owner, its data scope and its tools in the processing inventory. See the Agentic AI Compliance Guide.
- Machine credentials are the breach path: API keys, service accounts and OAuth tokens that reach personal data are what attackers reuse. Section 39 and the Article 29 schedule ("authentication checks", "encryption reviews") should cover them explicitly: vault storage, rotation, least privilege and owner attestation. See the Non-Human Identity (NHI) Guide.
- Transfers hide in tool calls: an agent that sends prompts containing personal data to a model endpoint abroad is a cross-border transfer under Part VIII and a mandatory DPIA trigger under Article 28(3)(o). Log where each model and tool endpoint is hosted.
- The 72-hour clock needs machine telemetry: you cannot assess a leaked token within 72 hours unless you know what data it could reach. Map each credential to the datasets behind it before an incident.
Compliance steps
- Classify the entity: decide whether you are a DCPMI and at which level using Schedule 7, and record the reasoning. Foreign controllers should still assess section 2(2) reach.
- Register and appoint: register on the NDPC services portal, appoint and publish the DPO, and set a 60-day change-notification process.
- Build the inventory: map personal data stores, processors, transfers and the human and non-human identities with access. See the Data Mapping and ROPA Guide.
- Fix the bases: retire NDPR-era wording, run Schedule 8 legitimate interest assessments, and redesign cookie notices to allow accept and decline.
- Run and file DPIAs: list processing that falls within Article 28(3), file DPIAs before go-live, and add AI deployments under Article 43.
- Write the security schedule: produce the Article 29 schedule, have it certified, and align it to an established framework such as ISO/IEC 27001 or NIST CSF 2.0.
- Rehearse the 72-hour path: define "aware", name who decides, pre-draft the Article 33(5) content and test a tabletop that starts from a leaked machine credential. See the Incident Response Guide.
- Prepare the CAR: engage a licensed DPCO early, collect evidence against the Schedule 2 areas (governance, security controls, accountability and risk, transfers, third parties) and file by 31 March.
Framework mapping
| NDPA / GAID duty | NIST CSF 2.0 | NIST SP 800-53 r5 | ISO/IEC 27001:2022 Annex A |
|---|---|---|---|
| Legal requirements understood (registration, CAR) | GV.OC-03 | PT-2 | 5.31, 5.34 |
| Inventory of data and identities | ID.AM-07, PR.AA-01 | AC-2 | 5.9, 5.16 |
| Security measures and credentials (s39, Art 29) | PR.DS-01, PR.AA-05 | IA-5, AC-6 | 8.5, 8.24 |
| DPIA (s28, Art 28) | GV.OC-03 | RA-8 | 5.34 |
| Processors (s29, Art 34) | GV.SC-05 | SA-9 | 5.19, 5.20 |
| Monitoring and breach notice (s40, Art 33) | DE.CM-01, RS.CO-02 | AU-2, IR-6 | 5.24, 5.26, 8.15 |
Metrics that show it is working
- Median hours from first alert to "aware" decision, and from "aware" to NDPC submission (target under 72).
- Percentage of Article 28(3) processing operations, including AI agents, with a filed DPIA.
- Percentage of machine credentials with access to personal data that have a named owner and rotation in the last 90 days.
- Percentage of processors with an Article 34-compliant agreement and current security evidence.
Common failure patterns
- Still running the NDPR playbook: privacy notices and audit evidence that cite the repealed NDPR 2019 or the 2020 framework.
- Treating the CAR as a document exercise: the DPCO samples devices, access and processors; a policy pack with no evidence of controls does not hold up.
- Waiting for certainty before starting the clock: the 72 hours start at awareness; teams that wait for forensic confirmation file late.
- Forgetting third-party processors: the Fidelity Bank decision cited non-compliant processors; contracts without Article 34 content are a finding.
- Invisible transfers: SaaS, analytics and AI endpoints abroad with no recorded section 41 basis, as the MultiChoice case illustrates.
- Machine credentials out of scope: security schedules that cover staff accounts and ignore service accounts, API keys and agent tokens.
Practitioner checklist
- Record your DCPMI level and the Schedule 7 reasoning, and register within six months of qualifying.
- Appoint a DPO reporting to management, publish the contact details and diary the semi-annual report.
- Replace NDPR references and run legitimate interest assessments on the Schedule 8 template.
- List every Article 28(3) trigger, including AI deployments and cross-border transfers, and file DPIAs before processing.
- Produce the Article 29 security schedule and have it certified by a certified information security officer.
- Inventory service accounts, API keys and agent identities that reach personal data, with owners and rotation.
- Define "aware", pre-draft the Article 33(5) notice and test the 72-hour path at least yearly.
- Record a section 41 or 43 basis for every transfer, including model and tool endpoints.
- Engage a licensed DPCO before January and file the CAR by 31 March.
Standards and references
- Nigeria Data Protection Commission: Nigeria Data Protection Act General Application and Implementation Directive (GAID) 2025
- National Assembly of Nigeria: Nigeria Data Protection Act 2023 (text as passed, hosted by KPMG Nigeria)
- Nigeria Data Protection Commission: Official website, registration, CAR and breach services
- Aluko and Oyebode: NDPC GAID takes effect on 19 September
- Mondaq: The Nigeria Data Protection Commission issues the GAID 2025
- Mondaq (Templars): Data protection compliance in Nigeria, audit return obligations for 2026
- BusinessDay: NDPC concludes 246 investigations
- ICIR: NDPC fines MultiChoice Nigeria N766 million over data privacy violations
Related NHI Mgmt Group resources: Kenya Data Protection Act Guide · South Africa POPIA Guide · Global Privacy Regulatory Map · Breach Notification Laws by Country Guide. This guide summarises the Nigeria Data Protection Act 2023 and the NDPC General Application and Implementation Directive 2025 as published at the date above and is not legal advice.