Skip to content
Emergency helpGet started
Compliance & Governance

Nigeria Data Protection Act 2023: the NDPA, the NDPR and the GAID

The Nigeria Data Protection Act 2023, the NDPR and the GAID: who the NDPA applies to, NDPC registration, 72-hour breach notice and penalties.
By VigilbasePublished
Read the guideMore Topics

The Nigeria Data Protection Act 2023 (NDPA) is Nigeria's data protection law. Signed on 12 June 2023, it established the Nigeria Data Protection Commission (NDPC) to regulate the processing of personal data. It applies to organizations operating in Nigeria, to processing that takes place in Nigeria, and to organizations elsewhere that process the personal data of people in Nigeria. The NDPC's General Application and Implementation Directive (GAID), issued in March 2025, explains how to apply the Act, and since its issuance the Commission no longer applies the Nigeria Data Protection Regulation (NDPR) 2019. This guide summarizes the Act and the GAID, and shows where security operations evidence helps.

How does the NDPA relate to the NDPR and the GAID?

The National Information Technology Development Agency (NITDA) issued the Nigeria Data Protection Regulation in January 2019. The NDPA is an Act of the National Assembly. Section 64 kept regulations and other documents issued by NITDA or the Nigeria Data Protection Bureau in effect until they expire or are repealed, replaced or altered, and references to the Bureau are read as references to the Commission. The GAID states that, on its issuance, the Commission ceases to apply the NDPR 2019 as a legal instrument for regulating data privacy and protection, without affecting anything done under the NDPR before then. Under section 63, the NDPA prevails over any other law that is inconsistent with it on the processing of personal data.
1.NDPR 2019: the regulation issued by NITDA. The Commission stopped applying it as a legal instrument when the GAID was issued.
2.NDPA 2023: the Act that sets the obligations, data subject rights, registration duties and penalties, and established the NDPC.
3.GAID 2025: the NDPC's directive on applying the Act, with schedules for compliance audit returns, data privacy impact assessments, cross-border transfers and registration.

Who does the NDPA apply to?

Section 2 applies the Act to the processing of personal data, by automated means or not, where the data controller or data processor is domiciled in, resident in or operating in Nigeria, where the processing occurs within Nigeria, or where a controller or processor outside Nigeria processes the personal data of a data subject in Nigeria. The GAID explains that operating in Nigeria includes a controller or processor that targets data subjects in Nigeria, even if it is not domiciled or resident there. Processing solely for personal or household purposes is excluded.

What are the NDPA's principles of data processing?

Section 24 requires data controllers and data processors to ensure that personal data is processed according to these principles. They must use appropriate technical and organisational measures to ensure the confidentiality, integrity and availability of personal data, and they owe a duty of care and must demonstrate accountability for the principles.
1.Processed in a fair, lawful and transparent manner.
2.Collected for specified, explicit and legitimate purposes, and not further processed in an incompatible way.
3.Adequate, relevant and limited to the minimum necessary.
4.Retained for no longer than necessary.
5.Accurate, complete, not misleading and, where necessary, kept up to date.
6.Processed with appropriate security, including protection against unauthorised or unlawful processing, access, loss, destruction, damage or any form of data breach.

What security measures does the NDPA require?

Section 39 requires appropriate technical and organisational measures to ensure the security, integrity and confidentiality of personal data, taking into account the amount and sensitivity of the data, the likely harm, the extent of the processing, the retention period and the cost of the measures. The GAID asks controllers and processors to keep schedules for monitoring, evaluating and maintaining their data security systems, covering items such as software updates, vulnerability tests of databases, authentication checks and encryption reviews.
1.Pseudonymisation or other de-identification, and encryption of personal data.
2.Processes to ensure the security, integrity, confidentiality, availability and resilience of processing systems and services.
3.Processes to restore availability of and access to personal data in a timely manner after a physical or technical incident.
4.Periodic assessments of risks to processing systems and services, including transmission over electronic communications networks.
5.Regular testing, assessment and evaluation of the measures, and regular updates to address shortcomings and evolving risks.

How quickly must a data breach be reported in Nigeria?

Under section 40, a data controller must notify the NDPC within 72 hours of becoming aware of a breach that is likely to result in a risk to the rights and freedoms of individuals. Where a breach is likely to result in a high risk to a data subject, the controller must communicate it to the data subject immediately, in plain and clear language. A data processor must notify the controller that engaged it on becoming aware of a breach. Controllers and processors must keep a record of all personal data breaches, with the facts, the effects and the remedial action taken. The NDPC's website links to a privacy breach reporting service.
1.The GAID lists what a notification to the Commission should include: the circumstances, the date or period of the breach, the personal data involved, an assessment of the risk of harm, an estimate of the individuals at real risk, the steps taken to reduce harm and to notify individuals, and a contact person.
2.Each notification and communication must give a point of contact, the likely consequences, and the measures taken or proposed to address the breach.

Who must register with the NDPC?

Section 44 requires data controllers and data processors of major importance to register with the Commission. The Act defines them as controllers or processors domiciled, resident or operating in Nigeria that process the personal data of more than a number of data subjects in Nigeria set by the Commission, or that the Commission designates because they process personal data of particular value or significance to Nigeria's economy, society or security. The GAID sorts them into Ultra-High, Extra-High and Ordinary-High levels: Ultra-High and Extra-High register once and file compliance audit returns each year, by 31 March for organizations established before 12 June 2023, while Ordinary-High renew their registration annually. A data controller of major importance must also designate a Data Protection Officer.

What are the penalties under the NDPA?

After an investigation, the NDPC can order a controller or processor to remedy a violation, compensate data subjects, account for profits, or pay a penalty or remedial fee. For a data controller or processor of major importance, the maximum is the greater of ₦10 million and 2% of its annual gross revenue in the preceding financial year. For others, it is the greater of ₦2 million and 2%. Failing to comply with a compliance order is an offence, punishable by a fine of up to the same maximum, imprisonment of up to one year, or both.

How Vigilbase supports NDPA work

Vigilbase does not make an organization NDPA compliant, and it does not replace your Data Protection Officer. It helps you run some of the security measures that section 39 and the GAID describe, and produce evidence that they are monitored, tested and kept up to date. This guide summarizes the Act and the GAID. It is not legal advice: your Data Protection Officer and legal advisers decide what the NDPA requires of your organization.
1.Vigilbase OS connects the security tools you already pay for and keeps their logs and events auditable and queryable in one place, which supports regular monitoring and evaluation of your security systems.
2.The Vigil agent investigates high-severity incidents, and each investigation records the evidence, the actions taken and the verification result. That record helps you assemble the facts, effects and remedial action that a breach record and a 72-hour notification need.
3.Managed Cloudflare runs WAF, DDoS, bot and DNS controls on the agreed scope, which supports the availability and resilience of the services you expose to customers.
4.Default retention is set per dataset, typically 30 to 90 days. If you must keep records longer, decide where that archive lives before you consolidate.

Key Takeaways

✓The NDPA 2023 is Nigeria's data protection law, and the Nigeria Data Protection Commission (NDPC) enforces it.
✓Since the GAID was issued in March 2025, the NDPC no longer applies the NDPR 2019 as a legal instrument.
✓Breaches likely to put individuals' rights at risk must be notified to the NDPC within 72 hours.
✓Data controllers and processors of major importance must register with the NDPC, and controllers of major importance must designate a Data Protection Officer.
✓Vigilbase helps you operate and evidence security measures; it does not certify compliance.

Sources

Related Solutions

Vigilbase services related to this guide

Managed SOC

Learn more

Managed Cloudflare

Learn more

Vigilbase OS

Learn more

Cybersecurity and Cloudflare in Nigeria

Learn more

Cloudflare Enterprise in Nigeria

Learn more

Frequently Asked Questions

What is the Nigeria Data Protection Act?

The Nigeria Data Protection Act 2023 (NDPA) is Nigeria's data protection law. It sets principles and lawful bases for processing personal data, gives data subjects rights, requires security measures and breach notification, and established the Nigeria Data Protection Commission (NDPC) to enforce it.Privacy and data handling

Is the NDPR still in force?

The NDPC no longer applies it. The GAID, issued in March 2025, says that on its issuance the Commission ceases to apply the NDPR 2019 as a legal instrument for regulating data privacy and protection. Anything done under the NDPR before then is not affected. Work to the NDPA 2023 and the GAID.

What is the difference between the NDPA and the NDPR?

The NDPR 2019 was a regulation issued by NITDA. The NDPA 2023 is an Act of the National Assembly that established the Nigeria Data Protection Commission and sets the obligations, rights, registration duties and penalties. The NDPC's GAID 2025 explains how to apply the Act.

How quickly must a data breach be reported under the NDPA?

Within 72 hours of becoming aware of it, if the breach is likely to result in a risk to the rights and freedoms of individuals. If it is likely to result in a high risk to a data subject, the controller must also tell the data subject immediately.Data processors must notify the controller that engaged them on becoming aware of a breach, and every controller and processor must keep a record of all personal data breaches.Security operations responsibilitiesWhat a SIEM does

Who has to register with the NDPC?

Data controllers and data processors of major importance. The GAID classifies them as Ultra-High, Extra-High or Ordinary-High level, which sets whether they register once and file annual compliance audit returns or renew their registration every year.

What are the penalties under the NDPA?

For a data controller or processor of major importance, a penalty or remedial fee can reach the greater of ₦10 million and 2% of annual gross revenue in the preceding financial year. For others, the maximum is the greater of ₦2 million and 2%.

Can Vigilbase make us NDPA compliant?

No. Vigilbase helps you operate and evidence security measures: connected logs stay queryable, investigations record the evidence, actions and verification, and Managed Cloudflare keeps change history and incident notes. Your Data Protection Officer and legal advisers decide what the NDPA requires of you.Get started with Vigilbase OSSecurity documentation in the Trust Center

Related Topics

Security Basics

What is SIEM?

Security Basics

What is SOC?

Compliance & Governance

Which Managed Cloudflare tier should a financial services team buy?

Compliance & Governance

POPIA compliance

Compliance & Governance

Kenya Data Protection Act

Get Started

Ready to Improve Your Security?

Our team can help you implement the security measures discussed in this guide. Get expert guidance tailored to your organization.
Get started Continue Learning