Nigeria’s data protection framework now rests on two instruments: the Nigeria Data Protection Act 2023 (NDPA), and the General Application and Implementation Directive 2025 (GAID). The Act was signed in June 2023 and set up the Nigeria Data Protection Commission (NDPC) as the regulator. The GAID was issued by the NDPC on 20 March 2025 and took effect on 19 September 2025, replacing the Nigeria Data Protection Regulation 2019 and its implementation framework.
If your organisation still describes its compliance in terms of the old regulation, that is the first thing to update.
Who it affects
The framework applies to organisations that process personal data within its scope. It makes a distinction between organisations in general and those the framework calls data controllers and processors of major importance. Which category you fall into depends on the classification criteria in the GAID, so check them rather than assuming.
What changes if you are of major importance
The NDPA and GAID establish additional obligations for designated data controllers and processors of major importance. These include registration with the NDPC, designation of a Data Protection Officer (who can be an employee or an external provider), and compliance audits. The filing requirements depend on the organisation’s classification. Ultra-High Level and Extra-High Level organisations must submit annual Compliance Audit Returns, with 31 March each year as the filing date, while Ordinary-High Level organisations renew their registration annually. The applicable deadlines, fees and requirements are set out in the GAID and its schedules.
How classification works
The GAID places organisations of major importance in three levels: Ultra-High, Extra-High and Ordinary-High. The criteria combine the volume of people whose data you process over a period with the sector you operate in and the sensitivity of the data. A small organisation in a regulated sector can qualify on sector or data type alone, so volume is not the only test. Read the classification schedule of the GAID before deciding that you are out of scope.
What applies more widely
Whatever your size, the same ideas run through the framework: have a lawful reason for each use of personal data, tell people what you do with it, respect their rights, keep it secure, and be able to show what you have done. Where processing is likely to be high risk, a data protection impact assessment is expected.
Breaches
Under section 40 of the Act, a controller must notify the NDPC within 72 hours of becoming aware of a breach that is likely to put people’s rights and freedoms at risk, and must tell affected individuals where the risk is high. Having a tested breach process before an incident happens makes that deadline realistic.
Where to start
A sensible first step does not need a lawyer or a tool. Write down what personal data you hold, why you hold it, who else handles it for you, where it goes, and how long you keep it. That one exercise tells you which obligations apply, which suppliers need contracts, and where your risks are.
One common mistake organisations make when moving from the NDPR to the NDPA and GAID is treating compliance as a documentation update. They revise their privacy policies, update website notices and assume the work is complete, without reviewing their actual data-processing activities, third-party processors, retention practices or breach-response procedures. A policy that references the new law does not demonstrate compliance if the organisation’s day-to-day handling of personal data has not changed.
