NigeriaNigeria Data Protection Regulation 2019 (NDPR), general data protection duties
Nigeria Data Protection Regulation 2019 (issued by the National Information Technology Development Agency on ) clauses 1.2, 2.1-2.3, 2.5-2.7, 2.10-2.12
A comprehensive regime rule binding public and private bodies.
- Obligation class
- Consent, Disclosure, Security, Transfer
As of .
What it requires
- Process personal data only on a lawful basis the Regulation lists, the first being the data subject's consent to the processing for one or more specific purposes, and obtain no data unless the specific purpose of collection is made known to the data subject (clauses 2.2 and 2.3(1)).
- Where you rely on consent, be able to demonstrate that the data subject consented, obtain it without fraud, coercion or undue influence, present the request for consent in a manner clearly distinguishable from other matters, and inform the data subject beforehand of the right and method to withdraw consent (clause 2.3(2)).
- Display a simple and conspicuous privacy policy that the targeted class of data subjects can understand on any medium through which you collect or process personal data (clause 2.5).
- Develop security measures to protect data, and govern any processing by a third party with a written contract that makes the third party adhere to the Regulation (clauses 2.6 and 2.7).
- Transfer personal data to a foreign country only where the Agency has decided that the country ensures an adequate level of protection, or where one of the conditions in clause 2.12 applies in the absence of such a decision (clauses 2.11 and 2.12).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Penalty structure
Clause 2.10(a): for a data controller dealing with more than 10,000 data subjects, a fine of 2% of the Annual Gross Revenue of the preceding year or 10 million Naira, whichever is greater. Clause 2.10(b): for a controller dealing with fewer than 10,000 data subjects, 1% of the Annual Gross Revenue of the preceding year or 2 million Naira, whichever is greater. The clause applies in addition to any other criminal liability.
- Rule
- Higher of
- As of
- Currency
- NGN
- Fixed cap
- 10,000,000
- Turnover percentage cap
- 2
What this law does
The Nigeria Data Protection Regulation 2019 was issued by the National Information Technology Development Agency under the National Information Technology Development Agency Act of 2007. It applies to all transactions intended for the processing of personal data of natural persons residing in Nigeria and of Nigerian citizens residing abroad.
It makes processing lawful on listed bases, the first being the data subject's consent to specific purposes, requires a simple and conspicuous privacy policy on any medium through which personal data is collected, requires security measures and a written contract with any third-party processor, and allows transfer to a foreign country where the Agency has decided that the country ensures an adequate level of protection, with exceptions where it has not.
A controller found in breach of a data subject's privacy rights pays a fine of 2% of the preceding year's annual gross revenue or 10 million Naira, whichever is greater, where it deals with more than 10,000 data subjects, and 1% or 2 million Naira, whichever is greater, where it deals with fewer.
The Nigeria Data Protection Commission's General Application and Implementation Directive 2025 provides that upon its issuance the Commission ceases to apply the Regulation as a legal instrument for regulating data privacy and protection, without affecting anything done under it before.
When LexLint raises it
When your app profile says your app processes personal data.