The Nigeria Data Protection Act 2023: a complete guide for businesses

Key facts

Does the NDPA apply to your business?

Almost certainly. Section 2 applies the Act to the processing of personal data, by automated means or not, where:

• the controller or processor is domiciled in, resident in or operating in Nigeria;
• the processing happens in Nigeria; or
• the controller or processor is outside Nigeria but processes personal data of a data subject in Nigeria.

That last point covers foreign companies: a UK fintech with Nigerian users, a US online shop that ships to Lagos, or a school abroad recruiting Nigerian students.

There is no exemption for small businesses. Section 3 exempts processing for purely personal or household purposes, and relieves some obligations for listed purposes such as criminal investigations by a competent authority, public health emergencies, national security, journalism and legal claims.

NDPA, NDPR and the GAID 2025

• NDPR 2019: the Nigeria Data Protection Regulation, which came before the Act. The NDPC stopped applying it as a legal instrument when it issued the GAID 2025, without affecting anything done under it before then (GAID Art. 3(3)). Many people still search for "NDPR compliance".
• NDPA 2023: an Act of the National Assembly. It created the NDPC and is now the main law.
• GAID 2025: the NDPC's directive on applying the Act in practice, covering registration tiers, the CAR, DPOs, impact assessments, transfers and complaints. It was issued on 20 March 2025.

If your privacy policy or contracts cite only the NDPR, update them to the NDPA and the GAID.

What every organisation must do

1. Have a lawful basis for each use of data. Section 25 lists six: consent, a contract with the person, a legal obligation, vital interests, a public task or official authority, and legitimate interests.
2. Be able to prove consent. The controller carries the burden of proof (s.26(1)). Silence or inactivity is not consent (s.26(3)), and people must be told they can withdraw it before they give it (s.26(4)). A cookie banner that does not record each choice cannot prove anything. How Izini records consent.
3. Tell people what you do with their data in a privacy policy before you collect it from them (s.27).
4. Assess high-risk processing with a data protection impact assessment before you start (s.28).
5. Hold your processors to the same standard (s.29). Your CRM, payroll, cloud and marketing vendors all count. Vendor checks in Izini.
6. Take extra care with sensitive data (s.30): genetic and biometric data, race or ethnic origin, religious or similar beliefs, health, sex life, political opinions and trade union membership.
7. Get a parent's or guardian's consent for children when you rely on consent, and use appropriate ways to verify age (s.31).
8. Keep data secure with appropriate technical and organisational measures (s.39).
9. Designate a Data Protection Officer if you are of major importance (s.32). The DPO can be on staff or under a service contract (GAID Art. 11). Izini for DPOs.

Registration and the Compliance Audit Return

Data controllers and processors of major importance must register with the NDPC (s.44). Under GAID 2025 Schedule 7, you are of major importance if you process the personal data of more than 200 data subjects in six months, carry out commercial ICT services on other people's devices, or work in a listed sector: aviation, communication, education, power, export and import, financial services, health, hospitality, insurance, oil and gas, tourism, e-commerce or public service.

Schedule 7 also places named types of organisation in a tier directly, whatever their volume: commercial banks, telecoms, insurers, fintechs and payment gateways are UHL, for example, and micro finance banks and higher institutions are EHL. Where the text does not settle your tier, for example at exactly 1,000 or 5,000 data subjects, confirm it with your DPCO or DPO.

The Compliance Audit Return (CAR) is your yearly evidence of compliance. UHL and EHL organisations file it through a licensed DPCO (GAID Art. 9(2), 10(14)):

• established before 12 June 2023: by 31 March each year (Art. 10(7));
• established after: within 15 months of being set up, then every year (Art. 10(8));
• a late CAR carries an administrative penalty of 50% of the filing fee, on top of the fee (Art. 10(9)).

The hard part of the CAR is the evidence: policies, records of processing, impact assessments, training records, the breach log and vendor checks. Gathering it as you go is far easier than rebuilding it every March. How Izini builds the CAR evidence pack.

Data subject rights

People whose data you hold, whether customers, staff, applicants or website visitors, have the right to:

• confirmation that you process their data, details of the processing, and a copy of it (s.34);
• correction, or deletion where correction is not feasible (s.34(1)(c));
• erasure without undue delay (s.34(1)(d)), and restriction of processing while a request or objection is resolved (s.34(1)(e));
• withdraw consent at any time (s.35);
• object to processing, including for direct marketing (s.36);
• not be subject to a decision based solely on automated processing, including profiling (s.37);
• data portability (s.38).

The Act asks you to respond "without constraint or unreasonable delay" (s.34(1)). It does not set a number of days. Izini tracks each request against a 30-day internal target so you can show you answered promptly. The request register.

Data breaches: the 72-hour rule

If a breach is likely to result in a risk to people's rights and freedoms, the controller must notify the NDPC within 72 hours of becoming aware of it (s.40(2)). If it is likely to result in a high risk, you must also tell the people affected immediately, in plain and clear language, with advice on protecting themselves (s.40(3)).

The clock starts when you become aware, not when the investigation ends. Have the steps ready:

1. Log the incident and the time you became aware of it.
2. Contain it.
3. Assess the risk to individuals, decide whether notification is required, and record why.
4. Notify the NDPC, and the people affected if the risk is high.
5. Fix the cause and keep the record for your CAR.

Izini starts the 72-hour clock when an incident is logged.

Sending data outside Nigeria

Cloud hosting abroad, a foreign parent company and overseas vendors all involve transfers. Under section 41 you may transfer personal data out of Nigeria only if:

• the recipient is bound by a law, binding corporate rules, contractual clauses, a code of conduct or a certification mechanism that gives adequate protection (s.41(1)(a), s.42); or
• one of the conditions in section 43 applies, such as the person's informed consent, performance of a contract with them, or legal claims.

Record the basis for each transfer and why the protection is adequate (s.41(2)). Unlawful transfer of data out of Nigeria was among the findings in the NDPC's ₦766 million fine against MultiChoice Nigeria.

Penalties

Under section 48, the NDPC can order you to remedy a violation, pay compensation to people harmed, and pay a penalty of up to:

• ₦10 million or 2% of the previous year's annual gross revenue, whichever is greater, if you are of major importance;
• ₦2 million or 2%, whichever is greater, for everyone else.

The NDPC has fined MultiChoice Nigeria ₦766 million (July 2025), Fidelity Bank ₦555.8 million (August 2024) and Meta $32.8 million (February 2025). See the enforcement tracker for what each was for and the sources.

NDPA compliance checklist

• Map the personal data you hold, where it lives and who can reach it
• Record a lawful basis for each processing activity
• Publish a privacy policy that covers section 27
• Run a cookie banner that holds non-essential scripts until consent and records each choice
• Check whether you are of major importance, and register with the NDPC if you are
• Designate a DPO
• Run impact assessments for high-risk processing
• Put agreements in place with every processor
• Record the basis for every transfer out of Nigeria
• Set up a way to receive and answer data subject requests
• Write a breach plan built around the 72-hour deadline
• Train staff and keep the records
• File your CAR through a licensed DPCO (UHL and EHL)

Izini covers this list in one place: consent in English, Yorùbá, Igbo, Hausa and Pidgin, the request register, records and impact assessments, vendor and transfer checks, staff training, the 72-hour breach clock and the CAR evidence pack. Paid plans include guided setup with our team. See everything Izini does.

Questions

Sources

1. Nigeria Data Protection Act, 2023 (Act No. 37), official text, NDPC
2. NDP Act General Application and Implementation Directive (GAID) 2025, NDPC
3. NDPC, Frequently asked questions (penalties under section 48)
4. Izini enforcement tracker, with a source for each fine

This guide is general information about the law as of 27 October 2026. It is not legal advice, and Izini does not replace your DPCO, DPO or lawyer.