Izini
Everything Izini does →Is the NDPR still in force?
Not as the rulebook the regulator applies. The GAID 2025 says that on its issue the NDPC "shall cease to apply" the NDPR 2019 as a legal instrument for regulating data privacy and protection (GAID Art. 3(3)). The GAID is dated 20 March 2025.
The rules that apply now are:
- The Nigeria Data Protection Act 2023 (Act No. 37), in force since 12 June 2023. Where any other law on processing personal data conflicts with it, the Act prevails (s.63).
- The GAID 2025, the NDPC's directive on applying the Act. Where the GAID and the Act conflict, the Act prevails (GAID Art. 3(2)).
Our NDPA guide covers the Act's duties in full.
What carries over from the NDPR era
- What you did before: stopping the NDPR does not affect anything done under it before the GAID was issued (GAID Art. 3(3)).
- Documents from NITDA and the Bureau: orders, rules, regulations, licences, certificates, approvals, registrations and other documents issued by NITDA or the Nigeria Data Protection Bureau before the Act stay in effect, as if issued by the Commission, until they "expire or are repealed, replaced, reassembled or altered" (NDPA s.64(2)(f)).
- The regulator: references to the Bureau, and documents issued in its name, are read as references to the Commission (s.64(1)).
Read together: the Act kept older instruments alive until replaced, and the GAID then set the NDPR aside going forward. If you rely on a specific NDPR-era licence, certificate or approval, ask your DPCO or lawyer how it stands today.
NDPR vs NDPA side by side
| Topic | NDPR 2019 | NDPA 2023 and GAID 2025 |
|---|---|---|
| What it is | A regulation issued by NITDA under the NITDA Act 2007 (Preamble) | An Act of the National Assembly, 2023 No. 37, in force since 12 June 2023 |
| Regulator | NITDA, "the Agency" | The Nigeria Data Protection Commission (s.4) |
| Who is protected | Natural persons residing in Nigeria, and Nigerian citizens residing abroad (1.2(b)) | Applies where the controller or processor is domiciled, resident or operating in Nigeria, the processing happens in Nigeria, or the data is of a data subject in Nigeria (s.2(2)) |
| Lawful bases | Five: consent, contract, legal obligation, vital interests, public interest (2.2) | Six: the same five plus legitimate interests (s.25(1)) |
| Data Protection Officer | Every data controller (4.1(2)) | Data controllers of major importance (s.32(1)) |
| Registration | No registration of controllers in the text | Organisations of major importance register with the NDPC (s.44), in the UHL, EHL or OHL tier (GAID Schedule 7) |
| Yearly filing | Controllers with more than 2,000 data subjects in 12 months sent NITDA an audit summary by 15 March (4.1(7)); those with more than 1,000 in six months also sent a summary of their first audit (4.1(6)) | UHL and EHL file a Compliance Audit Return through a licensed DPCO unless the Commission approves otherwise: by 31 March if established before 12 June 2023, otherwise within 15 months of being set up, then every year (GAID Art. 9(2), 10(7), 10(8), 10(14)) |
| Impact assessments | No standalone impact assessment duty; the audit had to state the policies for assessing the impact of technologies on privacy and security (4.1(5)(j)) | A data privacy impact assessment before processing likely to result in a high risk (s.28) |
| Breaches | No breach-notification rule in the text | Notify the NDPC within 72 hours of becoming aware of a breach likely to result in a risk to people's rights and freedoms (s.40(2)) |
| Answering requests | If not acting on a request, tell the person why within one month (3.1(2)) | Act "without constraint or unreasonable delay" (s.34(1)); the Act sets no fixed number of days. A grievance notice on the GAID's standard form asks for a decision within the time the person sets or 30 days, whichever is earlier (GAID Art. 40, Schedule 9) |
| Transfers abroad | Under the supervision of the Attorney General of the Federation, on an adequacy decision or a listed exception (2.11, 2.12) | On adequacy of protection or one of the other bases in the Act (ss.41-43) |
| Fines | More than 10,000 data subjects: the greater of 2% of annual gross revenue or ₦10 million; fewer: the greater of 1% or ₦2 million (2.10) | A maximum, not a fixed fine. Major importance: up to the greater of ₦10 million or 2% of the previous year's annual gross revenue; others: up to the greater of ₦2 million or 2% (s.48(3)-(5)) |
| Complaints | An Administrative Redress Panel set up by NITDA (4.2) | Complaints to the NDPC, which investigates and can make enforcement orders (ss.46, 48) |
| Licensed DPCOs | Licensed by NITDA (4.1(4)) | Licensed by the Commission (s.33) |
Section numbers in the NDPR column are the NDPR's own paragraph numbers; the rest refer to the Act unless marked GAID.
What changed for businesses
- Registration is new. If you are of major importance you register with the NDPC and pay a tier fee. See who must register and the fees.
- The yearly filing moved. The 15 March audit summary to NITDA has given way to the Compliance Audit Return, filed by UHL and EHL organisations through a licensed DPCO unless the Commission approves otherwise. See the CAR guide.
- The DPO duty narrowed. The NDPR asked every controller for a DPO; the Act asks it of controllers of major importance.
- Legitimate interests is now a lawful basis, with limits: an interest is not legitimate where it overrides the data subject's fundamental rights, freedoms and interests, is incompatible with the other lawful bases, or the person would not reasonably expect their data to be used that way (s.25(2)).
- Breaches and impact assessments have explicit rules: 72 hours to tell the NDPC about a breach likely to put people at risk (s.40(2)), and a data privacy impact assessment before high-risk processing (s.28).
- The penalties changed. The NDPR's line was 10,000 data subjects; the Act's is whether you are of major importance. The Act's amounts are maximums, and the lower tier's percentage rose from 1% to 2%.
What to update if you complied with the NDPR
- Replace NDPR and NITDA references in your privacy policy, contracts and staff guidance with the NDPA 2023, the GAID 2025 and the NDPC
- Check the privacy policy against what section 27 of the Act requires
- Work out whether you are of major importance, and register if you are
- Put the right yearly deadline in your calendar: the CAR for UHL and EHL, renewal for OHL
- Review each lawful basis you rely on, and document any legitimate interest assessment
- Set up a breach process that can notify the NDPC within 72 hours
- Add a data privacy impact assessment step for high-risk processing
Izini is built on the Act and the GAID 2025, not the NDPR: registration tiers and fees, the CAR evidence pack, the breach log with the 72-hour clock, and impact assessments. See everything Izini does.
Questions
Is the NDPR still in force?
Not as the rulebook the NDPC applies. When it issued the GAID 2025, the NDPC stopped applying the Nigeria Data Protection Regulation (NDPR) 2019 as a legal instrument for regulating data privacy and protection, without affecting anything done under the NDPR before then (GAID Art. 3(3)). The law today is the Nigeria Data Protection Act 2023, applied through the GAID 2025.
Are things we did under the NDPR still valid?
The GAID says stopping the NDPR does not affect anything done under it before the GAID was issued (Art. 3(3)), and the Act keeps documents issued by NITDA or the Nigeria Data Protection Bureau in effect, as if issued by the Commission, until they expire or are repealed, replaced, reassembled or altered (NDPA s.64(2)(f)). What you do from now on is measured against the Act and the GAID. If a licence, certificate or approval you hold matters to you, ask your DPCO or lawyer how it stands.
Is the 15 March NDPR audit filing still due?
No. The NDPR asked controllers that processed the personal data of more than 2,000 people in 12 months to send NITDA a summary of their data protection audit by 15 March of the following year (NDPR 4.1(7)). Today, organisations of major importance in the UHL and EHL tiers file a Compliance Audit Return through a licensed DPCO, unless the Commission approves otherwise: by 31 March if they were established before 12 June 2023, otherwise within 15 months of being set up and then every year (GAID Art. 9(2), 10(7), 10(8), 10(14)).
Does every business still need a Data Protection Officer?
The NDPR required every data controller to designate one (NDPR 4.1(2)). The Act requires it of data controllers of major importance (NDPA s.32(1)). If you are not of major importance, the Act does not oblige you to appoint a DPO, but its other duties still apply to you.
Our privacy policy cites the NDPR. Do we need to change it?
Yes. Base it on the Act: section 27 sets what the privacy policy must tell people, and the NDPC is now the regulator people can complain to. Replace references to the NDPR and NITDA with the NDPA 2023, the GAID 2025 and the NDPC.
Are the fines different under the NDPA?
Yes, in three ways. The NDPR set a fine of the greater of 2% of annual gross revenue or ₦10 million for controllers dealing with more than 10,000 data subjects, and the greater of 1% or ₦2 million for those with fewer (NDPR 2.10). The Act sets a maximum rather than a fixed fine: up to the greater of ₦10 million or 2% of the previous year's annual gross revenue for organisations of major importance, and up to the greater of ₦2 million or 2% for the rest (NDPA s.48(3)-(5)). So the lower tier's percentage rose from 1% to 2%, and the dividing line is now major importance rather than 10,000 data subjects.
Sources
- Nigeria Data Protection Act, 2023 (Act No. 37), official text, NDPC: sections 2, 4, 25, 27, 28, 32, 33, 34, 40, 41-43, 44, 46, 48, 63 and 64
- NDP Act General Application and Implementation Directive (GAID) 2025, NDPC: Articles 3, 9, 10 and 40, Schedules 7 and 9
- Nigeria Data Protection Regulation 2019, NITDA (copy published by the NDPC): Preamble and paragraphs 1.2, 2.2, 2.10, 2.11, 2.12, 3.1, 4.1 and 4.2