The Nigeria Data Protection Act 2023: a complete guide for businesses

Key facts

Key terms in plain English

These come from section 65 of the Act.

• Personal data: any information relating to an individual who can be identified, directly or indirectly, for example by a name, an identification number, location data or an online identifier.
• Sensitive personal data: genetic and biometric data used to identify a person, race or ethnic origin, religious or similar beliefs, health status, sex life, political opinions or affiliations, trade union membership, and anything else the NDPC prescribes.
• Processing: anything done with personal data, automated or not, from collecting and storing it to using, sharing and deleting it. It does not include the mere transit of data that originates outside Nigeria.
• Data controller: whoever decides, alone or with others, why and how personal data is processed.
• Data processor: whoever processes personal data on behalf of, or at the direction of, a controller or another processor.
• Consent: a freely given, specific, informed and unambiguous indication of agreement, by a written or oral statement or an affirmative action.
• Personal data breach: a breach of security that leads, or is likely to lead, to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data.

Does the NDPA apply to your business?

Almost certainly. Section 2 applies the Act to the processing of personal data, by automated means or not, where:

• the controller or processor is domiciled in, resident in or operating in Nigeria;
• the processing happens in Nigeria; or
• the controller or processor is outside Nigeria but processes personal data of a data subject in Nigeria.

That last point covers foreign companies: a UK fintech with Nigerian users, a US online shop that ships to Lagos, or a school abroad recruiting Nigerian students.

There is no exemption for small businesses. Section 3 sets out the exemptions:

• Personal or household use is outside the Act, provided it does not violate anyone's fundamental right to privacy (s.3(1)).
• Certain purposes are relieved of most of the duties in Part V of the Act: processing by a competent authority for the prevention, investigation, detection, prosecution or adjudication of a criminal offence, for the prevention or control of a national public health emergency, or as necessary for national security; publication in the public interest for journalism, educational, artistic and literary purposes, to the extent the obligations are incompatible with those purposes; and processing necessary for legal claims (s.3(2)). Even then, the principles (s.24), the lawful bases (s.25), the DPO duty (s.32) and the breach rules (s.40) still apply.
• The NDPC can prescribe further exemptions by regulation (s.3(3)).

NDPA, NDPR and the GAID 2025

• NDPR 2019: the Nigeria Data Protection Regulation, which came before the Act. The NDPC stopped applying it as a legal instrument when it issued the GAID 2025, without affecting anything done under it before then (GAID Art. 3(3)). Many people still search for "NDPR compliance".
• NDPA 2023: an Act of the National Assembly. It created the NDPC and is now the main law.
• GAID 2025: the NDPC's directive on applying the Act in practice, covering registration tiers, the CAR, DPOs, impact assessments, transfers and complaints. It was issued on 20 March 2025.

If your privacy policy or contracts cite only the NDPR, update them to the NDPA and the GAID.

The principles behind every duty

Section 24 requires every controller and processor to make sure personal data is:

1. processed fairly, lawfully and transparently;
2. collected for specified, explicit and legitimate purposes, and not used later in a way that is incompatible with them;
3. adequate, relevant and limited to the minimum necessary;
4. kept no longer than necessary for the lawful basis it was collected on;
5. accurate, complete, not misleading and, where necessary, kept up to date; and
6. kept secure against unauthorised or unlawful processing, loss, destruction, damage or any form of breach.

You must also use appropriate technical and organisational measures to keep data confidential, intact and available (s.24(2)), and you owe a duty of care and must be able to show you follow these principles (s.24(3)). That last point is why records matter as much as the measures themselves.

What every organisation must do

1. Have a lawful basis for each use of data. Section 25 lists six: consent, a contract with the person, a legal obligation, vital interests, a public task or official authority, and legitimate interests.
2. Be able to prove consent. The controller carries the burden of proof (s.26(1)). Silence or inactivity is not consent (s.26(3)), and people must be told they can withdraw it before they give it (s.26(4)). A cookie banner that does not record each choice cannot prove anything. How Izini records consent.
3. Tell people what you do with their data before you collect it from them, in a privacy policy written in clear, concise and easily accessible language (s.27(1), (3)). It must cover who you are and how to contact you, the lawful basis and purposes, who receives the data, people's rights, how long you keep the data, their right to complain to the NDPC, and any automated decision-making or profiling. If you collect data from someone other than the person it is about, you must still tell them, unless they already know or it is impossible or disproportionate (s.27(2)).
4. Assess high-risk processing with a data privacy impact assessment before you start (s.28(1)). It describes the processing and its purpose, assesses whether it is necessary and proportionate, assesses the risks to people, and sets out the measures to address them (s.28(4)). If a high risk remains despite those measures, consult the NDPC before you go ahead (s.28(2)).
5. Hold your processors to the same standard (s.29). Your CRM, payroll, cloud and marketing vendors all count. Vendor checks in Izini.
6. Take extra care with sensitive data (s.30): genetic and biometric data, race or ethnic origin, religious or similar beliefs, health, sex life, political opinions and trade union membership.
7. Get a parent's or guardian's consent for children when you rely on consent, and use appropriate ways to verify age (s.31).
8. Keep data secure with appropriate technical and organisational measures (s.39).
9. Designate a Data Protection Officer if you are of major importance (s.32). The DPO can be on staff or under a service contract (GAID Art. 11). Izini for DPOs.

Registration and the Compliance Audit Return

Data controllers and processors of major importance must register with the NDPC (s.44). Under GAID 2025 Schedule 7, you are of major importance if you process the personal data of more than 200 data subjects in six months, carry out commercial ICT services on other people's devices, or work in a listed sector: aviation, communication, education, power, export and import, financial services, health, hospitality, insurance, oil and gas, tourism, e-commerce or public service.

Schedule 7 also names types of organisation for each tier: commercial banks, telecoms, insurers, fintechs and payment gateways are listed under UHL, for example, and micro finance banks and higher institutions under EHL. Where the text does not settle your tier, for example at exactly 1,000 or 5,000 data subjects, or where a named type's volume falls in a different band, confirm it with your DPCO or DPO. The NDPC registration guide covers the tiers, fees and what to submit in detail.

The Compliance Audit Return (CAR) is your yearly evidence of compliance. UHL and EHL organisations file it through a licensed DPCO (GAID Art. 9(2), 10(14)):

• established before 12 June 2023: by 31 March each year (Art. 10(7));
• established after: within 15 months of being set up, then every year (Art. 10(8));
• a late CAR carries an administrative penalty of 50% of the filing fee, on top of the fee (Art. 10(9)).

The CAR guide covers the filing fees, what the template asks and the evidence to prepare.

The hard part of the CAR is the evidence: policies, records of processing, impact assessments, training records, the breach log and vendor checks. Gathering it as you go is far easier than rebuilding it every March. How Izini builds the CAR evidence pack.

Data subject rights

People whose data you hold, whether customers, staff, applicants or website visitors, have the right to:

• confirmation that you process their data, details of the processing, and a copy of it (s.34);
• correction, or deletion where correction is not feasible (s.34(1)(c));
• erasure without undue delay (s.34(1)(d)), and restriction of processing while a request or objection is resolved (s.34(1)(e));
• withdraw consent at any time (s.35);
• object to processing, including for direct marketing (s.36);
• not be subject to a decision based solely on automated processing, including profiling (s.37);
• data portability (s.38).

The Act asks you to respond "without constraint or unreasonable delay" (s.34(1)). It does not set a number of days. Izini tracks each request against a 30-day internal target so you can show you answered promptly. The request register.

Data breaches: the 72-hour rule

If a breach is likely to result in a risk to people's rights and freedoms, the controller must notify the NDPC within 72 hours of becoming aware of it (s.40(2)). If it is likely to result in a high risk, you must also tell the people affected immediately, in plain and clear language, with advice on protecting themselves (s.40(3)). Where contacting them directly would involve disproportionate effort or expense, or is not feasible, you may instead make a public announcement in widely used media.

A processor that suffers a breach must tell the controller that engaged it, describing the breach, and answer the controller's questions (s.40(1)). Every notification must give a point of contact, the likely consequences of the breach, and the measures taken or proposed to deal with it (s.40(4)).

The clock starts when you become aware, not when the investigation ends. Have the steps ready:

1. Log the incident and the time you became aware of it.
2. Contain it.
3. Assess the risk to individuals, decide whether notification is required, and record why.
4. Notify the NDPC, and the people affected if the risk is high.
5. Fix the cause and keep the record for your CAR.

Izini starts the 72-hour clock when an incident is logged.

Sending data outside Nigeria

Cloud hosting abroad, a foreign parent company and overseas vendors all involve transfers. Under section 41 you may transfer personal data out of Nigeria only if:

• the recipient is bound by a law, binding corporate rules, contractual clauses, a code of conduct or a certification mechanism that gives adequate protection (s.41(1)(a), s.42); or
• one of the conditions in section 43 applies, such as the person's informed consent, performance of a contract with them, or legal claims.

Record the basis for each transfer and why the protection is adequate (s.41(2)). Unlawful transfer of data out of Nigeria was among the findings in the NDPC's ₦766 million fine against MultiChoice Nigeria.

Penalties

Anyone aggrieved by how a controller or processor has handled their data can complain to the NDPC, which may investigate complaints that are not frivolous or vexatious, and can also open an investigation on its own (s.46(1)-(3)). After an investigation, section 48 lets it order you to remedy the violation, pay compensation to people harmed, account for profits made from the violation, and pay a penalty of up to:

• ₦10 million or 2% of the previous year's annual gross revenue, whichever is greater, if you are of major importance;
• ₦2 million or 2%, whichever is greater, for everyone else.

The NDPC has fined MultiChoice Nigeria ₦766 million (July 2025), Fidelity Bank ₦555.8 million (August 2024) and Meta $32.8 million (February 2025). See the enforcement tracker for what each was for and the sources.

NDPA compliance checklist

• Map the personal data you hold, where it lives and who can reach it
• Record a lawful basis for each processing activity
• Publish a privacy policy that covers section 27
• Run a cookie banner that holds non-essential scripts until consent and records each choice
• Check whether you are of major importance, and register with the NDPC if you are
• Designate a DPO
• Run impact assessments for high-risk processing
• Put agreements in place with every processor
• Record the basis for every transfer out of Nigeria
• Set up a way to receive and answer data subject requests
• Write a breach plan built around the 72-hour deadline
• Train staff and keep the records
• File your CAR through a licensed DPCO (UHL and EHL)

Izini covers this list in one place: consent in English, Yorùbá, Igbo, Hausa and Pidgin, the request register, records and impact assessments, vendor and transfer checks, staff training, the 72-hour breach clock and the CAR evidence pack. Paid plans include guided setup with our team. See everything Izini does.

Questions

Sources

1. Nigeria Data Protection Act, 2023 (Act No. 37), official text, NDPC
2. NDP Act General Application and Implementation Directive (GAID) 2025, NDPC
3. NDPC, Frequently asked questions (penalties under section 48)
4. Izini enforcement tracker, with a source for each fine

This guide is general information about the law as of 31 October 2026. It is not legal advice, and Izini does not replace your DPCO, DPO or lawyer.