Nigeria Data Protection Act (NDPA) 2023

Comprehensive data protection framework introducing data localization requirements for government contracts and establishing the Nigeria Data Protection Commission as supervisory authority.

JurisdictionNigeria
CategoryPrivacy & Data Protection
StatusActive
Latest development

Analysis

Key Requirements

The Nigeria Data Protection Act (NDPA) 2023 introduces several key requirements:

  • Establishment of the Nigeria Data Protection Commission (NDPC) as the primary regulatory body for data protection in Nigeria. The NDPC is responsible for enforcing compliance and issuing guidelines. Source: Nigeria Data Protection Act, 2023
  • Registration of Data Controllers and Processors: Organizations processing personal data of Nigerian residents must register with the NDPC within 6 months of the Act's commencement or becoming a data controller/processor. Source: NDPA Section 44
  • Appointment of Data Protection Officers (DPOs): Data controllers and processors of "major importance" must designate a DPO with expert knowledge of data protection laws and practices. Source: NDPA Section 33
  • Data Protection Impact Assessments (DPIAs): Organizations must conduct DPIAs for high-risk processing activities and consult with the NDPC if the DPIA indicates high risks. Source: NDPA Section 28
  • Cross-Border Data Transfers: Personal data can only be transferred to countries with adequate data protection laws or where other safeguards are in place. Source: NDPA Section 41
  • Data Breach Notification: Data controllers must notify the NDPC of personal data breaches within 72 hours of becoming aware. Source: NDPA Section 40

Compliance Challenges

Organizations face several challenges in complying with the NDPA:

  • Lack of Clarity on "Major Importance" Classification: The Act introduces a new category of data controllers and processors of "major importance" but does not provide clear criteria for this classification. Source: KPMG Analysis
  • Implementing New Consent Requirements: The Act requires that consent be freely given, specific, informed, and unambiguous, which may require updates to existing consent mechanisms. Source: DLA Piper Analysis

Implementation Best Practices

To implement NDPA requirements effectively:

  • Conduct a Data Mapping Exercise: Identify all personal data processing activities to determine registration requirements and assess risks. Source: ICLG Data Protection Guide
  • Utilize Data Protection Impact Assessment Tools: Implement DPIA tools to systematically assess and mitigate privacy risks. Source: ICO DPIA Guidance
  • Establish a Data Breach Response Plan: Develop and test an incident response plan to ensure timely notification of breaches. [Source: NDPC Guidelines (when available)]

Recent Updates

As of July 2024, there have been no significant amendments to the NDPA since its enactment. However:

  • The NDPC is expected to issue implementation guidelines and regulations in the coming months. [Source: Nigeria Data Protection Commission Website (when available)]
  • Organizations should monitor the [NDPC official website] for updates on registration procedures and compliance deadlines.

Related Regulations

The NDPA interacts with several other regulations:

  • Nigerian Data Protection Regulation (NDPR) 2019: The NDPA supersedes the NDPR but maintains some continuity. Organizations compliant with NDPR will have a foundation for NDPA compliance. Source: NDPA Section 64
  • Cybercrimes (Prohibition, Prevention, etc.) Act 2015: This Act complements the NDPA by addressing cybersecurity issues. Source: Cybercrimes Act
  • General Data Protection Regulation (GDPR): The NDPA shares similarities with the GDPR, facilitating compliance for multinational organizations. Source: GDPR Text

Industry Impact

The NDPA is expected to have significant impacts across various industries:

Sources

Recent developments

  • — Tech Hive Advisory’s 2025 retrospective notes that Nigeria’s data protection framework “matured significantly” under the NDPA, with the regulator shifting from policy-making to active implementation and sanctions, making non‑compliance an “immediate reality.”[1] (source)
  • — NDPC announced a sector‑by‑sector investigation of over 1,360 organisations for suspected non‑compliance with the NDPA, warning that failures could lead to fines, enforcement orders, or criminal proceedings.[4] (source)
  • — Advisory notes that NDPC has formally launched enforcement investigations and is demanding evidence of 2024 NDPA compliance audit returns, signalling a shift from awareness to active enforcement and higher regulatory risk for controllers and processors.[10] (source)
  • — NDPC published updates reminding “data controllers/processors of major importance” of mandatory registration, appointment of DPOs, and submission of annual audit returns under the NDPA, reinforcing compliance timelines and documentation expectations.[4][7] (source)
  • — The 2025–2026 Nigeria chapter confirms the NDPA 2023 as the primary data protection statute and highlights evolving regulatory focus on cross‑border transfers, high‑risk processing, and sector‑specific guidance, affecting how multinationals structure Nigerian operations.[8] (source)

Related regulations

Put it into practice

Browse all regulations · Compliance deadlines · Latest updates