Nigeria Data Protection Regulation (NDPR)

· About Nigeria Data Protection Regulation (NDPR)

Key Takeaways

  • The Nigeria Data Protection Regulation (NDPR) 2019 is no longer the operative data protection instrument in Nigeria; the Nigeria Data Protection Act 2023 and the General Application and Implementation Directive (GAID) 2025 now govern compliance.[3][4][12]
  • For organizations operating in Nigeria, the practical rule is that data processing must comply with the NDPA/GAID framework, and legacy NDPR/2020 framework obligations are treated as superseded from 19 September 2025.[4][10][12]
  • The Nigeria Data Protection Commission (NDPC) is the enforcement authority, and it can issue corrective orders, assess remedial fees, require compensation, and pursue criminal sanctions for non-compliance with orders.[6][7]
  • Organizations that are data controllers or processors of major importance face a maximum remedial fee of the greater of ₦10,000,000 or 2% of annual gross revenue; other organizations face the greater of ₦2,000,000 or 2% of annual gross revenue.[6][7]
  • The regime applies to both Nigerian and foreign organizations where personal data processing is connected to Nigeria, and the NDPC FAQ states that breaches can trigger administrative and criminal sanctions.[6][7]
  • Any compliance programme should now be built around NDPA/GAID controls, while mapping operational controls to ISO 27001, NIST CSF 2.0, and ISO 42001 where security, governance, and AI processing are involved.[4][6][7]

What It Is

The NDPR was Nigeria’s earlier general personal data regulation, but it has been displaced as the primary operating instrument by the Nigeria Data Protection Act 2023 and the GAID 2025, which the NDPC issued on 20 March 2025 and treated as effective from 19 September 2025.[4][12][15] The NDPC’s published materials and legal commentary indicate that, from that effective date, the NDPR 2019 and its NDPR Implementation Framework 2020 are no longer the active regulatory instruments for privacy and data protection in Nigeria.[3][4][8][10]

The enforcement body is the Nigeria Data Protection Commission (NDPC), which is the national regulator responsible for oversight, investigation, and sanctions.[6][7] The current compliance baseline is therefore the NDPA plus the GAID, not the NDPR alone.[4][10][12]

On timing, the important milestones are: the NDPC issued the GAID on 20 March 2025; the instrument became operative on 19 September 2025; and by 2026 the NDPC was publicly applying the NDPA/GAID framework in enforcement and guidance.[1][4][12] Because the user asked for NDPR status, the key point is that there is no 2025–2026 “delay” preserving the NDPR as the live regime; instead, the later NDPC instrument displaced it.[3][4][10]

Who Must Comply

The current Nigerian privacy regime applies to data controllers and data processors handling personal data in Nigeria, including public and private organizations.[6][7] The regime also has practical extraterritorial reach where an entity outside Nigeria processes personal data of people connected to Nigeria or otherwise falls within the scope of Nigerian data protection obligations under the NDPA/GAID framework.[4][10][15]

A major compliance distinction is whether the organization is a controller or processor of major importance (DCPMI), because that status increases the ceiling for penalties and usually reflects higher-risk or higher-volume processing.[6][7] The NDPC’s public FAQ also distinguishes between major-importance and non-major-importance entities for remedial fees and sanctions.[6]

The available primary materials do not describe a broad exemption from the privacy regime for ordinary commercial organizations; instead, the framework is general and organization-agnostic, with special treatment for certain regulated public-interest or security-related processing only where another law specifically limits disclosure or processing.[6][7] Where sector laws overlap, the safer approach is to treat the NDPA/GAID as the baseline and then test for narrower statutory carve-outs.

Core Requirements

  1. Lawful processing and data subject rights. Organizations must process personal data in a way that respects data privacy rights, and the NDPC can order remediation when those rights are breached.[6][7]
  1. Governance and accountability. Controllers and processors need internal governance that can evidence compliance, because the NDPC can investigate, issue corrective directions, and require accountings for profits arising from violations.[6][7]
  1. Security safeguards. Data protection compliance must include technical and organizational safeguards appropriate to the risks of the processing, especially where personal data is exposed to unauthorized access or misuse.[6][7]
  1. Breach response and regulatory cooperation. Organizations must be able to detect, investigate, and respond to incidents and to cooperate with NDPC directions, since non-compliance with orders can itself trigger sanctions.[6][7]
  1. Cross-border transfer controls. Transfers out of Nigeria must be managed under the current legal framework rather than under the old NDPR-only model, which was superseded by the GAID regime.[4][10][12]
  1. Records and auditability. Compliance must be demonstrable, not merely asserted, because the NDPC’s enforcement model relies on orders, remediation, and monetary sanctions tied to the processing conduct.[6][7]

Deadlines and Penalties

| milestone | date | what applies | |---|---:|---| | GAID issued | 20 March 2025 | NDPC formally published the GAID under the NDPA framework.[12][15] | | GAID effective / NDPR displaced | 19 September 2025 | NDPR 2019 and the 2020 Implementation Framework ceased to operate as the main privacy instruments.[1][3][4][10] | | Ongoing enforcement baseline | 2026 onward | NDPA + GAID govern compliance, guidance, and enforcement actions.[5][6] |

Maximum financial sanctions are tiered. For a data controller or processor of major importance, the NDPC FAQ states that the penalty or remedial fee may be the greater of ₦10,000,000 and 2% of annual gross revenue for the preceding financial year.[6] For a controller or processor not of major importance, the maximum is the greater of ₦2,000,000 and 2% of annual gross revenue.[6]

Other sanctions include orders to remedy the violation, compensate the affected data subject, and account for profits realized from the violation.[6] Separate commentary on the NDPA/GAID framework also notes that non-compliance with NDPC orders may expose an organization to imprisonment of up to one year.[7]

How to Comply

  1. Confirm the legal baseline. Replace any NDPR-only compliance map with an NDPA/GAID register that identifies all processing activities in Nigeria and any cross-border flows.[4][10][12]
  1. Classify the organization and processing. Determine whether the entity is a controller/processor of major importance and document the legal basis, purpose, recipients, retention, and transfer channels for each processing activity.[6][7]
  1. Build a governance framework. Use ISO 27001 for the security management system, with policies, asset inventory, access control, logging, incident response, and supplier oversight mapped to the organization’s processing risks.[6][7]
  1. Operationalize privacy risk management. Align privacy controls with NIST CSF 2.0 functions—identify, protect, detect, respond, and recover—so the programme covers both routine processing and breach handling.[6][7]
  1. Implement AI and automation governance where relevant. If personal data is used in AI systems, map governance to ISO 42001 for AI management, especially around data quality, transparency, human oversight, and documented risk treatment.
  1. Strengthen breach readiness. Maintain incident triage, legal review, regulatory escalation, and evidence preservation procedures so the organization can respond to NDPC directions and subject claims.[6][7]
  1. Test vendor and transfer controls. Put contractual, technical, and due diligence controls on processors, sub-processors, and foreign recipients, with transfer assessments and ongoing monitoring.[4][10][15]
  1. Audit and refresh periodically. Run periodic internal audits, close corrective actions, and review the compliance model against NDPC publications and any sector-specific guidance because the regulatory position has materially changed since 2025.[5][6][12]

Related Regulations

  • The Nigeria Data Protection Act 2023 is the main statute that now governs privacy compliance in Nigeria and supersedes the NDPR as the operating baseline.[4][10][12]
  • The NDPC General Application and Implementation Directive 2025 supplies the current implementation rules and timing for the post-NDPR regime.[4][12][15]
  • The Cybercrimes (Prohibition, Prevention, etc.) Act 2015 can overlap where a privacy incident also involves unlawful access, interference, or computer misuse.
  • Sector-specific rules from regulators such as the Central Bank of Nigeria may add confidentiality, outsourcing, or cybersecurity requirements for regulated financial institutions.
  • The General Data Protection Regulation (GDPR) may conflict or overlap for Nigerian entities serving EU residents, especially on transfers, legal basis, and breach handling.

FAQ

Does the NDPR still apply in Nigeria?

The NDPR is no longer the main operative privacy instrument in Nigeria. The NDPC’s 2025 GAID displaced the NDPR 2019 and the 2020 Implementation Framework from 19 September 2025.[3][4][10][12]

Does the Nigerian privacy regime apply to foreign companies?

Yes, where a foreign company processes personal data in a way that falls within Nigeria’s data protection scope, it must comply with the current NDPA/GAID framework.[4][10][15] The regime is not limited to companies incorporated in Nigeria.

What is a controller or processor of major importance?

The NDPC uses the major-importance category to distinguish higher-risk or higher-volume organizations for enforcement purposes.[6] That status matters because it raises the maximum remedial fee to the greater of ₦10,000,000 or 2% of annual gross revenue.[6]

What happens if an organization ignores NDPC orders?

The NDPC FAQ says a breach can lead to remedial orders, compensation, profit accounting, and remedial fees.[6] Commentary on the current framework also notes that failure to comply with NDPC orders may result in imprisonment of up to one year.[7]

Are there 2025–2026 delays that keep the NDPR alive?

No public primary source located here indicates a delay preserving the NDPR as the active regime through 2026. The available NDPC materials and legal analyses point the other way: the GAID became effective on 19 September 2025, and the NDPR ceased to be the operative instrument.[1][3][4][10][12]

Sources

Put it into practice

More compliance guides