What is the Nigeria Data Protection Act (NDPA)? A Comprehensive Guide to Data Privacy in Nigeria
In an era where data is the new oil, protecting personal information has become paramount for individuals and businesses alike. The Nigeria Data Protection Act (NDPA) 2023 stands as a cornerstone of data privacy law in Nigeria, establishing a robust framework to safeguard the rights of data subjects while enabling secure data processing in the digital economy. Enacted on June 12, 2023, by President Bola Tinubu, the NDPA addresses long-standing gaps in data protection, replacing and building upon earlier regulations like the Nigeria Data Protection Regulation (NDPR) 2019. This guide explores the NDPA in detail, its implications for businesses, and how organizations can achieve compliance to avoid hefty penalties.
Whether you’re a business owner navigating data privacy compliance in Nigeria or an individual concerned about your personal data rights, understanding the NDPA is essential. At Penlit & Greyson Legal Practice, we specialize in privacy and data protection law, helping clients across Nigeria stay ahead of regulatory changes.
Background and Objectives of the NDPA
The journey to the NDPA began nearly two decades ago, with intensified efforts in 2022 under the Nigeria Digital Identification for Development Project. The Act was drafted, validated, and passed by the National Assembly before receiving presidential assent. Its primary objectives include:
- Safeguarding the constitutional rights, freedoms, and interests of data subjects.
- Regulating the processing of personal data to promote security and best practices.
- Providing remedies for data breaches and ensuring accountability from data controllers and processors.
- Strengthening Nigeria’s digital economy and facilitating participation in global trade through trusted data handling.
By aligning with international standards like the GDPR, the NDPA positions Nigeria as a leader in African data protection, fostering trust in digital services.
Scope and Applicability: Who Does the NDPA Affect?
The NDPA has a wide-reaching scope, applying to any processing of personal data where:
- The data controller or processor is domiciled, resident, or operating in Nigeria.
- The data subject is in Nigeria, even if the processor is abroad (extraterritorial application).
Exemptions exist for personal or household processing (without infringing privacy), law enforcement, national security, public health emergencies, and legal claims. However, even exempt entities must adhere to certain obligations. Businesses handling data of Nigerian residents, regardless of location, must comply to avoid risks.
Key Definitions Under the NDPA
Understanding the terminology is crucial for NDPA compliance:
- Personal Data: Any information identifying an individual, such as names, IDs, location data, or factors related to physical, genetic, or economic identity.
- Sensitive Personal Data: Includes genetic/biometric data, race, religion, health, or political opinions.
- Data Controller: Entity determining the purpose and means of data processing.
- Data Processor: Entity processing data on behalf of a controller.
- Data Controllers/Processors of Major Importance: Those handling significant volumes of data or data critical to the economy, society, or security.
These definitions ensure clarity in roles and responsibilities.
Data Protection Principles: The Foundation of Compliance
The NDPA mandates adherence to core principles for all data processing:
- Lawfulness, Fairness, and Transparency: Processing must be legal and clearly communicated.
- Purpose Limitation: Data collected for specific, legitimate purposes only.
- Data Minimization: Only necessary data should be collected.
- Accuracy: Data must be up-to-date and accurate.
- Storage Limitation: Retain data no longer than needed.
- Integrity and Confidentiality: Protect against unauthorized access or breaches.
Controllers and processors owe a duty of care, ensuring accountability at every stage.
Lawful Bases for Processing Personal Data
Data processing is lawful under the NDPA if based on:
- Consent (specific, informed, and freely given; no implied consent allowed).
- Contract performance.
- Legal obligations.
- Vital interests protection.
- Public interest or official authority.
- Legitimate interests (balanced against data subject rights).
For sensitive data, explicit consent or substantial public interest is required. Businesses must document their basis to demonstrate compliance.
Rights of Data Subjects: Empowering Individuals
The NDPA grants data subjects extensive rights, including:
- Access to their data and its sources.
- Rectification or erasure of inaccurate data.
- Objection to processing, especially for marketing.
- Data portability.
- Restriction of processing.
- Withdrawal of consent.
- Protection from automated decision-making (ADM), with rights to human intervention.
Organizations must respond promptly to requests, typically without charge.
Obligations of Data Controllers and Processors
Key duties include:
- Conducting Data Protection Impact Assessments (DPIAs) for high-risk activities.
- Appointing a Data Protection Officer (DPO) for major importance entities.
- Ensuring consent for children (under 18) via guardians.
- Implementing security measures like encryption and risk assessments.
Major importance entities face stricter requirements, such as annual audits.
Data Security and Breach Notification
Controllers must notify the Nigeria Data Protection Commission (NDPC) of breaches within 72 hours if they pose risks, and inform affected subjects immediately if high-risk. Robust measures like pseudonymization and staff training are essential to prevent breaches.
Cross-Border Data Transfers
Transfers outside Nigeria require adequacy decisions, binding rules, or explicit consent. The NDPC assesses recipient countries’ protections. This ensures Nigerian data remains secure globally.
Enforcement and Penalties: The Role of the NDPC
The NDPC, an independent body, enforces the Act through investigations, audits, and remedies. Penalties for non-compliance can reach up to 2% of annual gross revenue or ₦10 million, depending on the entity’s size. Data subjects can seek court redress.
Recent Developments: The General Application and Implementation Directive (GAID)
In March 2025, the NDPC issued the GAID, effective September 19, 2025, replacing the NDPR. It provides practical guidance on registration, audits (with fees from ₦100,000 to ₦1,000,000), DPO roles, DPIAs, and cross-border transfers. Organizations must transition within six months.
Compliance Tips for Businesses in Nigeria
To comply with the NDPA:
- Conduct regular DPIAs and audits.
- Update privacy policies for transparency.
- Train staff on data handling.
- Appoint a DPO if applicable.
- Use tools like Legitimate Interest Assessments (LIAs).
Non-compliance risks fines and reputational damage—proactive steps are key.
How Penlit & Greyson Legal Practice Can Assist with NDPA Compliance
Navigating the NDPA can be complex, but you don’t have to do it alone. At Penlit & Greyson Legal Practice, our team of experienced data protection lawyers offers tailored services, including compliance audits, DPIA support, policy drafting, and representation in NDPC matters. We help businesses across sectors build robust privacy frameworks to thrive in Nigeria’s digital landscape.
Contact us today for a consultation or visit our website to learn more about our privacy and data protection services. Stay compliant, protect your data, and drive growth with expert guidance from Penlit & Greyson.
This article is for informational purposes only and not legal advice. For personalized support, reach out to our firm.