NDPA

What is the NDPA?

The Nigeria Data Protection Act, 2023 (NDPA) put data protection on a firm statutory footing. It replaced reliance on the earlier Nigeria Data Protection Regulation (NDPR) and created the Nigeria Data Protection Commission (NDPC) as an independent regulator. The NDPC’s General Application and Implementation Directive (GAID) gives detailed operational guidance.

Who does it apply to?

Processing of personal data by controllers or processors domiciled, resident or operating in Nigeria, or processing that takes place in Nigeria. It also covers controllers and processors outside Nigeria that process personal data of data subjects in Nigeria.

Key duties

• Principles and lawful bases: consent, contract, legal obligation, vital interests, public interest or legitimate interests, with stricter rules for sensitive data and children.
• Rights: information, access, rectification, erasure, restriction, portability, objection, and rights regarding automated decisions.
• Data controllers and processors of major importance: organisations designated by the NDPC, generally by volume and type of data processed, must register with the NDPC, appoint a data protection officer and file compliance audit returns.
• Impact assessments for high-risk processing.
• Security and breaches: implement appropriate measures, and notify the NDPC within 72 hours of becoming aware of a breach likely to risk individuals’ rights. Communicate to data subjects where risk is high.
• Cross-border transfers: only where the recipient is subject to adequate protection or other conditions in the Act apply.

Enforcement

For data controllers or processors of major importance, penalties can reach the higher of ₦10 million or 2% of annual gross revenue. Lower caps apply to others. The NDPC can also issue compliance orders.

How does it relate to other frameworks?

The NDPA aligns broadly with the GDPR and other African laws, such as Kenya’s DPA and South Africa’s POPIA, but registration and audit filing are Nigeria-specific.