Data protection in Nigeria.

The Nigeria Data Protection Act (NDPA), 2023 is Nigeria's principal data protection law, enacted on 12 June 2023. The Nigeria Data Protection Commission (NDPC) oversees it, and the heaviest duties fall on controllers and processors of major importance.

Get started Check your readiness

In force: June 2023
Regulator: NDPC
Maximum fine: Greater of NGN 10M or 2%

Abuja

At a glance

Nigeria, in seven lines.

Law: Nigeria Data Protection Act (NDPA), 2023
In force: Enacted 12 June 2023
Regulator: Nigeria Data Protection Commission (NDPC)
Registration: Controllers and processors of major importance register with the NDPC, within six months of the Act or of becoming of major importance
Data protection officer: Mandatory for controllers of major importance; may be an employee or an outsourced provider
Breach notification: Within 72 hours of awareness to the NDPC; data subjects immediately where there is a high risk
Maximum fines: Major importance: greater of NGN 10 million or 2% of annual gross revenue. Others: greater of NGN 2 million or 2%

A summary for orientation only, not legal advice. Requirements depend on your organisation; talk to us for an assessment.

Key obligations

What the law asks of you.

Four obligations organisations in Nigeria meet first, and where we help with each.

Register as a controller of major importance

Controllers and processors of major importance register with the NDPC.

DPO360 helps with

Registration and licensing filings with national data protection authorities

Appoint a Data Protection Officer

Mandatory for controllers of major importance. The DPO can be an employee or engaged under a service contract.

DPO360 helps with

Formal DPO appointment and mandate definition, where permitted by law

Breach notification

Notify the NDPC within 72 hours, and data subjects immediately where there is a high risk.

DPO360 helps with

Incident and breach logging, escalation and regulator notification

Transfers abroad

Transfers of personal data outside Nigeria need an adequate level of protection or appropriate safeguards.

DPO360 helps with

Cross-border data transfer governance: legal basis, safeguards and approvals

How the framework came together

From the law to the regulator.

2019
Data protection regulation
Nigeria's earlier data protection regulation sets the baseline for organisations processing personal data.
12 June 2023
The NDPA is enacted
The Nigeria Data Protection Act, 2023 becomes the principal law, formalising the NDPC as regulator.
March 2025
GAID 2025 is issued
The NDPC issues its General Application and Implementation Directive, with operational rules on registration and cross-border transfers.

NDPC

Regulatory authority

Nigeria Data Protection Commission (NDPC)

The NDPC oversees compliance with the NDPA, 2023, including the registration of controllers and processors of major importance.

Dr. Vincent Olatunji, National Commissioner

Visit the website

What the NDPC does

Registers major-importance controllers
Controllers and processors of major importance register with the NDPC.
Receives breach notifications
Breaches are notified to the NDPC within 72 hours.
Enforces the Act
Enforces the NDPA with fines linked to annual gross revenue.

Penalties

What non-compliance can cost.

Major importance

NGN 10M

or 2% of annual gross revenue, whichever is greater

For controllers and processors of major importance, the maximum is the greater of NGN 10 million or 2% of annual gross revenue in the preceding financial year.

Everyone else

NGN 2M

or 2% of annual gross revenue, whichever is greater

For other controllers and processors, the maximum is the greater of NGN 2 million or 2% of annual gross revenue in the preceding financial year.

Readiness check

Where do you stand?

Tick what is already in place. A quick read on where you stand in Nigeria, for orientation only.

0/6

Plenty to tighten.

A short scoping call will map the gaps and the order to close them.

Close the gaps with us

We know whether we are a controller or processor of major importance.This decides registration and DPO duties.
We are registered with the NDPC, if required.Major-importance controllers and processors register.
We have a Data Protection Officer, if required.Required for major-importance controllers and processors.
We can notify the NDPC within 72 hours of a breach.High-risk breaches also reach data subjects immediately.
Cross-border transfers have a lawful basis and safeguards.Transfers abroad need adequacy or safeguards.
Our policies and records of processing are documented.Documentation makes every other item easier to evidence.

Compare

Eight countries at a glance.

Tap a country to highlight its column. Scroll sideways for the rest.


Law	Protection of Personal Information Act (POPIA)	Data Protection Act, 2019	Nigeria Data Protection Act (NDPA), 2023	Data Protection and Privacy Act, 2019	Personal Data Protection Act, 2022	Law No. 058/2021	Data Protection Act, 2021	Data Protection Act, 2024
In force	July 2021 (most provisions from July 2020)	November 2019	June 2023	May 2019 (regulations March 2021)	May 2023	October 2021 (full compliance October 2023)	April 2021	June 2024
Regulator	Information Regulator	Office of the Data Protection Commissioner (ODPC)	Nigeria Data Protection Commission (NDPC)	Personal Data Protection Office (PDPO)	Personal Data Protection Commission (PDPC)	National Cyber Security Authority (NCSA)	Office of the Data Protection Commissioner	Malawi Communications Regulatory Authority (MACRA)
Registration	Register your Information Officer with the Regulator	Mandatory above thresholds, and in certain sectors, with the ODPC	Controllers and processors of major importance register with the NDPC	Every data collector, processor and controller registers with the PDPO	Collectors and processors register with the PDPC	Controllers and processors register with the NCSA	No one may act as a controller or processor without registering	Controllers and processors of significant importance register with MACRA
Data protection officer	Information Officer required for every organisation	May be designated; relevant for public bodies, large-scale monitoring and sensitive data	Mandatory for controllers of major importance	A DPO must be designated by the head of the institution	A DPO must be appointed	Required in certain cases (large-scale monitoring or sensitive data)	A DPO must be appointed, under the Commissioner's guidelines	Required for public authorities, and for large-scale monitoring or sensitive data
Breach notification	As soon as reasonably possible, to the Regulator and data subjects	Within 72 hours to the ODPC; data subjects within a reasonably practical period	Within 72 hours to the NDPC; data subjects immediately where high risk	Immediately, to the PDPO	Promptly, to the PDPC	Within 48 hours to the NCSA	Within 24 hours to the Commissioner; data subjects as soon as practicable	Within 72 hours to MACRA
Penalties	Administrative fines up to ZAR 10 million; up to 10 years' imprisonment for listed offences	Up to KES 5 million or 1% of annual turnover, whichever is lower; offences: up to KES 3 million and/or 10 years	Major importance: greater of NGN 10 million or 2% of annual gross revenue; others: greater of NGN 2 million or 2%	Up to about UGX 4.8 million and/or 10 years for listed offences	Penalty notices up to TZS 100 million; companies up to TZS 5 billion; individuals up to TZS 20 million and/or 10 years	Administrative fines of RWF 2 to 5 million or 1% of global turnover; corporate criminal fines of 5% of annual turnover	Corporate bodies: greater of 100 million penalty units or 2% of annual turnover; individuals up to 1 million penalty units and/or 5 years	Administrative penalties up to MWK 20 million; ignoring a compliance order: MWK 20 million and up to 5 years
	Open briefing →	Open briefing →		Open briefing →	Open briefing →	Open briefing →	Open briefing →	Open briefing →

A summary for orientation only, not legal advice. Requirements depend on your organisation; talk to us for an assessment.

Reviewed October 2026 against: Nigeria Data Protection Act, 2023 (sections 40 and 48) and the NDPC's General Application and Implementation Directive, 2025.

Additional resources

Read the source documents.

Nigeria Data Protection CommissionRegulator website Nigeria Data Protection Act 2023Legislation

Regional hub

Nigeria Hub

West & Northern Africa

DPO360 in Nigeria

How we support organisations in Nigeria.

Our Nigeria hub covers West & Northern Africa, so support for organisations in Nigeria is local to the region and close to the regulator.

Registration and licensing filings with the national authority
Breach logging, escalation and regulator notification
Consent, policy and records-of-processing frameworks
Data mapping, including where data is processed
Data subject access request management
A standing DPO appointment, with DPO-as-a-Service

39a Tai Solarin Ave, Gwarinpa, Abuja 900108

dpo360.ng@lawyeringafrica.com

+234 7901 569 623

Ready to Make Privacy Your Advantage?

Speak to our team about compliance in Nigeria and beyond.

Book a consultation DPO-as-a-Service

Data protection in Nigeria.

Nigeria, in seven lines.

What the law asks of you.

Register as a controller of major importance

Appoint a Data Protection Officer

Breach notification

Transfers abroad

From the law to the regulator.

Data protection regulation

The NDPA is enacted

GAID 2025 is issued

Nigeria Data Protection Commission (NDPC)

Registers major-importance controllers

Receives breach notifications

Enforces the Act

What non-compliance can cost.

Where do you stand?

Eight countries at a glance.

Read the source documents.

How we support organisations in Nigeria.

Ready to Make Privacy Your Advantage?