Understanding the Nigeria Data Protection Act

The Nigeria Data Protection Act 2023 (NDPA) is Nigeria’s main law on personal data. It created the Nigeria Data Protection Commission (NDPC) and sets out how organisations may collect, use, share, store and delete information about people.

Who it applies to

The Act applies to organisations that process personal data and are based in Nigeria, and to organisations elsewhere that process the personal data of people in Nigeria. “Processing” covers almost anything you can do with data, including collecting, recording, storing, sharing and deleting it.

The Act calls the organisation that decides why and how data is processed the data controller. An organisation that processes data on a controller’s behalf, such as a payroll provider or cloud service, is a data processor. Both have duties.

The core principles

Personal data must be:

• processed lawfully, fairly and transparently;
• collected for a specific, legitimate purpose and not used for something unrelated;
• adequate and limited to what is necessary;
• accurate and kept up to date;
• kept no longer than needed;
• protected with appropriate security.

Every use of personal data also needs a lawful basis, such as consent, a contract, a legal obligation, vital interests, a public task or legitimate interests.

Sensitive personal data

Some data needs extra care. This includes health information, religious or political beliefs, ethnic origin, sexual orientation and biometric and genetic data. Organisations need stronger justification and stronger safeguards before processing it.

Rights people have

The people whose data you hold can ask to access it, correct it, have it deleted, object to some uses, and in some cases move it to another provider. Organisations need a way to recognise and respond to these requests.

Registration and annual returns

The NDPC classifies some organisations as data controllers and processors of major importance. These must register with the Commission. Under the General Application and Implementation Directive (GAID) 2025, many of them must also file an annual compliance audit return, normally before 31 March, through a licensed Data Protection Compliance Organisation.

Penalties

The NDPC can order an organisation to remedy a breach, pay compensation or pay a remedial fee. For data controllers and processors of major importance, the fee can reach the greater of ₦10 million or 2% of annual gross revenue. For others, it can reach the greater of ₦2 million or 2%.

Where to start

1. Find out what you hold. List the personal data your organisation collects, where it is stored and who can access it.
2. Check your lawful basis. For each use, write down why you are allowed to do it.
3. Update your privacy notice so it describes what really happens.
4. Set retention rules and delete what you no longer need.
5. Check your security and your suppliers.
6. Train your staff. Most data protection failures are everyday habits, not technical faults.

If you are not sure whether registration or an annual return applies to you, an NDPA readiness assessment is a practical first step.

This article is general information, not legal advice. Check current requirements with the NDPC.