Data protection & privacy law in Nigeria (2026)

Legal framework

Nigeria Data Protection Act (NDPA) 2023, supervised by the Nigeria Data Protection Commission (NDPC), operationalized by the General Application and Implementation Directive (GAID) 2025.

Key points: data & privacy in Nigeria

1. 01Comprehensive primary law

   The Nigeria Data Protection Act 2023 is the country's general personal-data protection statute, in force since 12 June 2023; it sets out lawful bases, processing principles, and obligations across all sectors and repealed the NDPR 2019.

   ndpc.gov.ng ndpc.gov.ng

2. 02Supervisory authority

   The Act establishes the Nigeria Data Protection Commission (NDPC) as the regulator responsible for administering all data-protection matters, issuing regulations and guidelines, investigating complaints, conducting audits, and imposing administrative fines.

   ndpc.gov.ng en.wikipedia.org

3. 03Implementation directive (GAID 2025)

   The NDPC issued the General Application and Implementation Directive (GAID) on 20 March 2025, fully effective 19 September 2025, translating the Act's principles into operational compliance requirements and replacing the residual NDPR framework.

   ndpc.gov.ng iapp.org

4. 04Data subject rights

   Individuals have rights to be informed, access, rectification, erasure ('right to be forgotten'), data portability, restriction, objection, and protection against certain automated decision-making; rights extend to data subjects in Nigeria and, in defined cases, to Nigerians abroad.

   iapp.org dlapiperdataprotection.com

5. 05Controller/processor obligations

   Controllers and processors must apply lawful processing principles, register/file as 'data controllers or processors of major importance' where applicable, and notify the NDPC of personal-data breaches within 72 hours of becoming aware of them.

   dlapiperdataprotection.com iclg.com

6. 06Cross-border transfers and penalties

   Personal data may leave Nigeria only where the recipient country/organization offers adequate protection or another lawful mechanism applies; non-compliance can attract fines up to ₦10,000,000 or 2% of annual gross revenue for controllers/processors of major importance (₦2,000,000 or 2% for others), whichever is higher.

   dlapiperdataprotection.com ndpc.gov.ng

Timeline of decisions

1. 25 Aug 2025Enforcement
   NDPC Launches Sector-Wide Probe of 1,368 Organizations

   The Nigeria Data Protection Commission commenced sector-by-sector investigations against 1,368 entities, including 795 financial institutions, 392 insurance brokers, 136 gaming companies, and pension firms, for failing to file annual compliance audit returns, appoint Data Protection Officers, or register as major data controllers. Organizations were given 21 days to demonstrate compliance or face fines, enforcement orders, and criminal prosecution.

   Jones Day

2. 7 Jul 2025Enforcement
   NDPC Fines Multichoice Nigeria ₦766.2 Million for Data Privacy Breaches

   The NDPC imposed a ₦766,242,500 penalty on Multichoice Nigeria for illegal cross-border transfers of Nigerian subscribers' personal data and intrusive, disproportionate data processing. The fine, one of the largest under the NDPA framework, also triggered a mandatory compliance audit of all Multichoice data-collection channels.

   Vanguard News

3. 25 Apr 2025Decision · official
   Competition Tribunal Upholds $220 Million Fine Against Meta/WhatsApp

   The Competition and Consumer Protection Tribunal confirmed the FCCPC's landmark $220 million penalty against Meta Platforms, affirming Nigerian regulators' authority to sanction global tech companies for data misuse affecting Nigerian users. The ruling set binding precedent for data-sovereignty enforcement against foreign digital platforms.

   Federal Competition and Consumer Protection Commission (FCCPC)

4. 20 Mar 2025Guidance · official
   NDPC Issues General Application and Implementation Directive (GAID)

   The NDPC published the GAID to operationalise the NDPA 2023, establishing registration tiers (Ultra-High, Extra-High, Ordinary-High), DPO credentialing standards, breach notification timelines, DPIA requirements, and cross-border transfer mechanisms. Effective 19 September 2025, the GAID supersedes the NDPR 2019 as the operative administrative compliance instrument.

   Nigeria Data Protection Commission (NDPC)

5. 19 Jul 2024Enforcement
   FCCPC and NDPC Fine Meta $220 Million for Unauthorized Data Sharing

   After a 38-month joint investigation, the Federal Competition and Consumer Protection Commission fined Meta $220 million for unauthorized cross-border data sharing, discriminatory treatment of Nigerian users versus other jurisdictions, and abuse of dominant market position. The NDPC co-led the data-specific portion, making it the largest privacy penalty in Nigerian history.

   JURIST

6. 12 Jun 2023Law · official
   Nigeria Data Protection Act 2023 (NDPA) Signed into Law

   President Tinubu signed the NDPA on Democracy Day, enacting Nigeria's first standalone federal data-protection statute. The Act created the independent Nigeria Data Protection Commission, codified data subjects' rights, mandated cross-border transfer safeguards, and set penalties up to 2% of annual global turnover for serious violations, aligning Nigeria's framework with GDPR-era international standards.

   Nigeria Computer Emergency Response Team (ngCERT) / Federal Gazette

7. 4 Feb 2022Decision · official
   Nigeria Data Protection Bureau (NDPB) Established as Interim Standalone Authority

   President Buhari approved the creation of the NDPB, separate from NITDA, as Nigeria's first dedicated data-protection institution, mandated to consolidate NDPR enforcement and drive enactment of primary legislation. The NDPB later introduced the draft Data Protection Bill in October 2022 that became the NDPA 2023.

   Radio Nigeria (Federal Radio Corporation of Nigeria)

8. 1 Jan 2020Guidance · official
   NITDA Issues NDPR Implementation Framework

   NITDA published the Implementation Framework for the NDPR 2019, detailing the mandatory annual Data Protection Audit regime, the licensing and oversight of Data Protection Compliance Organisations (DPCOs), and sector-specific requirements. The Framework institutionalised the compliance-audit cycle that underpinned all pre-NDPA enforcement.

   National Information Technology Development Agency (NITDA)

9. 1 Dec 2019Enforcement
   NITDA Issues Non-Compliance Notices to 100 Companies

   NITDA sent formal enforcement notices to 100 organisations found processing personal data without adequate safeguards under the NDPR, signalling active regulatory intent less than a year after the regulation took effect. The action prompted widespread corporate compliance programs and established NITDA's credibility as an enforcer.

   Mondaq

10. 25 Jan 2019Law · official
    Nigeria Data Protection Regulation (NDPR) Issued by NITDA

    NITDA issued the NDPR, Nigeria's first comprehensive, cross-sectoral data protection instrument, covering lawful basis for processing, consent, data minimisation, purpose limitation, data subjects' rights, mandatory breach notification, and cross-border transfer restrictions. Although subsidiary legislation, the NDPR immediately became Nigeria's primary data-privacy framework and remained so until the NDPA 2023.

    National Information Technology Development Agency (NITDA)

11. 1 Jan 2007Law · official
    NITDA Act 2007 Enacted, Foundational Technology Governance Mandate

    The National Information Technology Development Agency Act established NITDA and empowered it to develop regulations for electronic data governance across public and private sectors in Nigeria. The Act served as the sole legislative basis under which the NDPR 2019 was issued and remained the operative foundation for data regulation until the NDPA 2023 replaced it with primary legislation.

    National Information Technology Development Agency (NITDA)

Sources

1. 1.ndpc.gov.ng/
2. 2.ndpc.gov.ng/about-us/
3. 3.ndpc.gov.ng/download/nigeria-data-protection-act-2023
4. 4.ndpc.gov.ng/wp-content/uploads/2025/07/NDP-ACT-GAID-2025-MARCH-20TH.pdf
5. 5.iapp.org/news/a/from-principles-to-practice-operationalizing-nigerias-data-pro
6. 6.dlapiperdataprotection.com/index.html?t=law&c=NG
7. 7.iclg.com/practice-areas/data-protection-laws-and-regulations/nigeria
8. 8.en.wikipedia.org/wiki/Nigeria_Data_Protection_Commission