DPIA in Nigeria: when you need a data privacy impact assessment, and how to do one

Key facts

What is a DPIA?

The Act defines a data privacy impact assessment as "a process designed to identify the risks and impact of the envisaged processing of personal data" (s.28(4)). It is done before you start, so that you can change or drop the processing if the risk is too high, rather than discovering the problem after a breach or a complaint.

The Act uses two names for it: "data privacy impact assessment" in section 28(1) and "data protection impact assessment" in section 28(2). Both are abbreviated DPIA. People also search for it as a "privacy impact assessment".

A DPIA is not the same as a legitimate interest assessment (LIA). The GAID's LIA template (Schedule 8) points you to the DPIA questions in Schedule 4, and says that if you answer yes to any of them you need to conduct a DPIA instead, to assess the risks in more detail.

When the Act requires a DPIA

Under section 28(1), a data controller must carry out a DPIA before processing personal data where the processing "may likely result in high risk to the rights and freedoms of a data subject by virtue of its nature, scope, context, and purposes".

The Act lets the NDPC make regulations or directives on DPIAs, including the categories of processing and the persons who must conduct one (s.28(3)). The GAID 2025, an NDPC directive under the Act, sets out such categories in Article 28(3). The GAID also lists conducting a DPIA when required under the Act, or when directed by the Commission, among its general compliance measures for data controllers and processors (Art. 7(o)).

The GAID also says that introducing new technologies, new processing techniques, or directives that require processing personal data on a large scale calls for a DPIA, because of the risk of unintended, adverse consequences to people's lives and livelihoods and to their fundamental rights (Art. 28(2)).

The 15 situations where the GAID makes a DPIA mandatory

The GAID says a DPIA "is mandatory and shall be filed with the Commission" in any of these circumstances (Art. 28(3)):

The examples column is our illustration; the situations are the GAID's own words. Two other articles also call for a DPIA:

• Software that tracks or communicates with people: anyone who deploys data processing software to track data subjects or create a communication link with them must carry out a DPIA before deploying it, and tell prospective users in a privacy statement before installation that a DPIA was conducted and its result indicates the software is unlikely to compromise data privacy and protection (Art. 31(2)(a), 31(2)(e)(vi)).
• Emerging technologies such as artificial intelligence, the Internet of Things and blockchain: the DPIA must assess disparate outcomes and data subjects' vulnerability, and is filed with the Commission as part of the CAR (Art. 43(4)(a)).

The Act and the GAID together. The Act sets the test: likely high risk. The GAID lists situations where it treats a DPIA as mandatory and to be filed. If your processing falls in one of the GAID situations, plan for a DPIA. If you are unsure whether it does, or whether your processing is likely to be high risk, confirm with your DPO or DPCO and keep a note of the decision.

When to do it

• New processing: before it starts. The Act says "prior to the processing" (s.28(1)), and the GAID says a required DPIA is carried out and submitted to the Commission before the processing commences (Art. 28(9)).
• Processing that existed before the Act and the GAID: the GAID gave six months from its issue to carry out a DPIA (Art. 28(10)).
• Software that processes sensitive personal data: the GAID gave four months from its issue to carry out a DPIA and submit it to the Commission (Art. 28(8)).

The GAID is dated 20 March 2025, so both windows have passed. If your existing processing falls in either case and you have no DPIA, start one now and discuss with your DPCO or DPO how to handle the delay.

What a DPIA must contain

The Act sets four required parts (s.28(4)):

1. a systematic description of the envisaged processing and its purpose, including the legitimate interest pursued by the controller, processor or third party;
2. an assessment of the necessity and proportionality of the processing in relation to its purposes;
3. an assessment of the risks to the rights and freedoms of data subjects; and
4. the measures envisaged to address the risks, including safeguards, security measures and mechanisms to protect personal data, taking into account the rights and legitimate interests of data subjects and others.

Where the DPIA concludes the processing may go ahead, the GAID adds that it must also contain measures that guarantee privacy by design and by default, taking into account seven principles (Art. 28(11)):

• be proactive, not reactive; preventive, not remedial;
• privacy as the default setting;
• privacy built into the design;
• full functionality: positive-sum, not zero-sum;
• end-to-end security across the full lifecycle;
• visibility and transparency; and
• respect for user privacy.

How to do a DPIA, step by step (GAID Schedule 4)

The GAID requires the DPIA to follow its Schedule 4 template (Art. 28(13)). Each section asks what to note, the material information you hold, and your assessment of whether that information is adequate. Where relevant, it also asks for a rating on a scale of 1 to 10. Missing information should make that part score low.

1. General background. The organisation's central work, why it processes personal data, and the main reasons for the DPIA.
2. Nature of the processing. Whether it is automated or manual; the types of data (for example customer or employee data) and the specific data items; who the data is about and how many people are affected; the risk of going beyond the intended scope; third parties involved; transfers to other countries and their legal justification; and the potential risks to people, such as unauthorised access or discrimination.
3. Lawful basis and context. The lawful basis and why you chose it, any prior relationship with the people concerned, and the class of data subjects targeted.
4. Necessity and proportionality. Why this method is essential to your lawful purpose, how it achieves your goal, how you will keep the data secure and respect privacy, and which alternatives you considered and why they would not work.
5. Consulting stakeholders. The template names the data subjects, the NDPC and internal decision-makers such as management, the Chief Information Security Officer, the DPO and the system's users. It suggests surveys, assessments and the manufacturer's instructions, with attention to confidentiality, integrity and availability.
6. Identified and potential vulnerabilities. Every possible risk, including mistakes by data subjects; risks to confidentiality, integrity and availability; the data subjects' vulnerability indexes that apply (see below); how quickly complaints are resolved and how well you can recover from a disaster; and whether the people involved understand the technical and organisational measures relevant to their role.
7. Degree of risk and severity of harm. A likelihood rating and a severity rating, using the definitions in the next section.
8. Potential disparate outcomes. How the processing could affect other rights, especially human dignity. The template's examples: a survey of a disadvantaged group for a good cause could still lead to stigmatisation if handled carelessly, and CCTV deployed for security can limit privacy or freedom of expression.
9. Cross-border transfer. The destination countries; the legal justification under sections 41-42 of the Act; for countries without an NDPC adequacy decision, the legal and technical safeguards for human rights there; other applicable laws, such as the ECOWAS Supplementary Act, the African Union Convention or the GDPR; how people can raise grievances; data sovereignty; and data security risks in those countries.
10. Principles and rights. How each principle of data protection and each data subject right operates in this processing, including whether you are accountable to the NDPC through registration and annual CAR filing.
11. Mitigation. Each risk, the simplest effective technical and organisational measure against it (for example strong passwords or access controls), the reminder that insurance does not replace your responsibility, how you will handle risks that remain (containment, notifying affected people), and whether to test in a sandbox first.
12. Final assessment. One of three outcomes, set out in the next section but one.
13. Frequency of review. Monthly, bi-monthly, quarterly, twice a year, annually, once every two years, or once in the lifecycle of the processing, with reasons.

Scoring likelihood and severity

Schedule 4 gives three levels for each. Choose the description that best fits your processing.

The GAID defines an "ultimate or decisive credential" as information such as a password or a token that, once provided, completes a transaction such as opening an email account or accessing a bank account or secure records.

The final assessment is one of three:

• Go ahead: the risk is remote and the recommendations are adequate.
• Modify the processing: it may go ahead only with the fundamental changes the DPIA recommends.
• Stop the processing: it appears unnecessary and disproportionate, taking into account less intrusive alternatives, the inherent risks and disparate outcomes.

If a high risk remains despite your measures, the Act requires you to consult the NDPC before you start (s.28(2)).

Vulnerable data subjects: the DSVI

The GAID asks you to consider each Data Subject's Vulnerability Index (DSVI): a risk factor peculiar to a person or group that, if ignored, may lead to unfair processing or a breach of the duty of care (Schedule 6). The DSVI to consider include, but are not limited to:

• age: being too old or being a minor;
• health;
• financial difficulty;
• physical disability; and
• lack of capacity to exercise free will, education, digital literacy, or access to online data security support.

Processing that relates to vulnerable data subjects is one of the 15 mandatory DPIA situations (Art. 28(3)(e)), and Schedule 4 asks you to state which DSVI apply.

Sign-off, filing and the CAR

• Vetting: a DPIA is vetted by a certified DPO accredited by the Commission (Art. 28(4)).
• Signature: a DPIA submitted to the Commission is signed by a duly certified DPO who is accredited by the Commission (Art. 28(12)).
• Filing: in the Article 28(3) situations, the GAID says the DPIA is filed with the Commission (Art. 28(3)), before the processing starts (Art. 28(9)).
• Prior consultation: if high risk remains despite your measures, consult the NDPC before processing (NDPA s.28(2)).
• The annual CAR: the outcome of a DPIA is part of the Compliance Audit Return (Art. 28(5)), for organisations that file a CAR: the UHL and EHL tiers (GAID Art. 9(2)-(3)). The CAR template asks whether you have ever carried out a DPIA, whether you deployed new technology in the last year, and whether you process sensitive data or target vulnerable people. See the CAR guide.

The GAID does not say how to submit a DPIA outside the CAR, for example through which portal. Ask your DPCO or DPO how they file it.

What happens if you skip it

The GAID says failure, refusal or negligence in conducting a DPIA may, among other enforcement provisions under Part X of the Act, lead to a restriction on all platforms where data subjects deal with you for transactions that need personal data (Art. 28(6)).

Part X of the Act also lets the NDPC investigate complaints and make enforcement orders and sanctions (ss.46, 48). When it opens a case file on a complaint, its notice of investigation may ask for your DPIAs for the technologies you rely on (GAID Art. 39(7)(d)). See the fines the NDPC has issued.

On the positive side, the GAID says submitting a DPIA, like registering and filing the CAR, "shows commitment to accountability and prima facie good faith", though it does not replace concrete evidence in defending a complaint (Art. 48(2)).

How a DPIA links to your other duties

• Data processing agreements: a DPA with a processor must include the outcome of a DPIA where relevant (GAID Art. 34(2)(k)).
• Security: the GAID says organisations of major importance determine their security measures in light of their DPIA outcomes (Schedule 1).
• Data ethics: you are expected to rely on a DPIA to assess the outcomes of a proposed processing activity, including potential disparate impact (Art. 42(5)(e)).
• The DPO's semi-annual report must cover the need for a DPIA where it applies to your processing (Art. 13(5)(e)).
• Records of processing: your record of processing is the natural starting point, since it already lists the purpose, data, people, recipients and transfers that the DPIA describes.

DPIA checklist

• List your processing activities and check each against the "likely high risk" test (s.28(1)) and the 15 GAID situations (Art. 28(3))
• Record the decision for each activity, with reasons, confirmed with your DPO or DPCO where unsure
• Complete the GAID Schedule 4 template for each activity that needs a DPIA, before it starts
• Cover the four parts the Act requires: description, necessity and proportionality, risks, measures (s.28(4))
• Rate likelihood and severity, and check the vulnerability indexes in Schedule 6
• Add privacy by design and by default measures if the processing goes ahead (Art. 28(11))
• Have the DPIA vetted and signed by a certified DPO accredited by the NDPC (Art. 28(4), 28(12))
• File it with the NDPC where the GAID requires, and consult the NDPC first if high risk remains (s.28(2))
• If you file a CAR, include the outcome in your next one (Art. 28(5))
• Set and diary the review frequency

Izini lists the processing activities that need an impact assessment, walks you through a guided assessment that scores the remaining risk, and tells you when you must consult the NDPC before going ahead. Your DPO still vets and signs it. See records and impact assessments in Izini.

Questions

Sources

1. Nigeria Data Protection Act, 2023 (Act No. 37), official text, NDPC: sections 28, 41-42, 46 and 48, and Part X
2. NDP Act General Application and Implementation Directive (GAID) 2025, NDPC: Articles 13, 28, 31, 34, 39, 42, 43 and 48; Schedules 1, 4 (DPIA template), 6 (Data Subject's Vulnerability Indexes) and 8 (Legitimate Interest Assessment)

This guide is general information about the law as of 10 November 2026. It is not legal advice, and Izini does not replace your DPCO, DPO or lawyer.