Law / Nigeria

Nigeria Data Protection Act, 2023 (NDPA), general data protection duties

Nigeria Data Protection Act 2023 (No. 37 of 2023), general duties (ss. 1-3, 24-29, 32-33, 39 and 63-65; GAID 2025, arts. 1-17, 19-32, 34-35 and 41-42)

In force since 12 Jun 2023.

A comprehensive regime rule binding public and private bodies.

How the hook was established: express
What makes it apply: Operator establishment, Market targeting, User location
Obligation class: Consent, Security, Governance, DPIA, Reporting
Audit expectation: periodic
Who audits it: Self, Registered or designated auditor
Where the report goes: Filed with regulator

What it requires

Register with the Commission as a data controller or data processor of major importance where the Commission so determines, conduct a compliance audit within fifteen months of commencing business and annually thereafter, and file Compliance Audit Returns by 31 March each year in the Ultra-High and Extra-High Level categories.NIST Privacy FrameworkGV.PO-P5 NIST Privacy FrameworkGV.MT-P3
Tell the Commission of any significant change to the information in your most recent registration submission within sixty days of the change.NIST Privacy FrameworkGV.PO-P5
Designate a Data Protection Officer as section 32 of the Act mandates, give the officer the position the Directive prescribes, and have the officer prepare semi-annual data protection reports.NIST Privacy FrameworkGV.PO-P3 NIST Privacy FrameworkGV.MT-P4
Process personal data on one of the lawful bases section 25 recognises, and hold to the section 24 principles of fairness, lawfulness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, confidentiality, integrity and availability.NIST Privacy FrameworkCT.PO-P1 NIST Privacy FrameworkGV.PO-P1
Take consent for cookies and other tracking tools freely, informed and specific, display a conspicuous cookie banner at the first part of the page, and let a data subject reject every cookie other than the necessary ones that carry security, network stability and accessibility.NIST Privacy FrameworkCT.PO-P1
Carry out a Data Privacy Impact Assessment where required, including where deploying software to process sensitive personal data, and file it with the Commission.NIST Privacy FrameworkID.RA-P4
Before deploying data processing software that tracks a data subject or opens a communication link with one, carry out an impact assessment, design it for privacy by design and by default, put a data privacy policy inside the software, and give a prospective user a privacy statement before installation.NIST Privacy FrameworkID.RA-P4 NIST Privacy FrameworkGV.PO-P2 NIST Privacy FrameworkCM.AW-P1
Put a Data Processing Agreement in place with any data processor you engage, setting out the obligations of both parties under section 29 of the Act.NIST Privacy FrameworkID.DE-P3
Follow schedules for monitoring, evaluating and maintaining the data security system, and for organisation-wide internal sensitisation and training on data privacy.NIST Privacy FrameworkPR.PO-P5 NIST Privacy FrameworkGV.AT-P1

These lines are LexLint's reading of the law's text.

In the frameworks

NIST Privacy Framework

ID.RA-P4Problematic data actions, likelihoods, and impacts are used to determine and prioritize risk.
ID.DE-P3Contracts with data processing ecosystem parties are used to implement appropriate measures designed to meet the objectives of an organization’s privacy program.
GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such as data uses or retention periods, individuals’ prerogatives with respect to data processing) are established and communicated.
GV.PO-P2Processes to instill organizational privacy values within system/product/service development and operations are established and in place.
GV.PO-P3Roles and responsibilities for the workforce are established with respect to privacy.
GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.

6 more

GV.AT-P1The workforce is informed and trained on its roles and responsibilities.
GV.MT-P3Policies, processes, and procedures for assessing compliance with legal requirements and privacy policies are established and in place.
GV.MT-P4Policies, processes, and procedures for communicating progress on managing privacy risks are established and in place.
CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
PR.PO-P5Protection processes are improved.

FINOS AIGF

AIR-PREV-005System Acceptance Testing
AIR-PREV-006Data Quality & Classification/Sensitivity
AIR-PREV-024Human-in-the-Loop Action Approval Gate
AIR-DET-004AI System Observability
AIR-DET-011Human Feedback Loop for AI Systems
AIR-DET-021Agent Decision Audit and Explainability

Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law

What it makes you log

Who may demand the log

Auditor or notified body

What the log must hold

Consent or opt-out state

Logging duty

Article 17(6) says that whenever a controller relies on consent it must keep a proper record that guarantees accountability in respect of the consent. Article 13(2) and (3) send the data protection officer's semi-annual report to the officer authorised to receive the controller's record of processing activities and make the report part of that record. The articles name no field the consent record must hold and no retention period, and the audit keys already on this row describe the Article 10 compliance audit. The territorial hooks are those of Article 1(2) read with section 2(2) of the Act; the Act's further prong for processing that occurs within Nigeria turns on where the processing happens, not on who or where the operator or data subject is, and is left out.

Kind

Explicit

As of

28 October 2026

Provision

GAID 2025, Article 17(6), and Article 13(2) and (3)

Trigger

consent_or_optout
personal_data_processing

Why the legislator wanted it

The Directive, which the Commission issues under the Act, ties the consent record to accountability for the way consent was obtained.

As of: 28 October 2026
Quote: Whenever a data controller relies on consent, it shall keep a proper record that guarantees accountability in respect of the consent.
Source link: https://ndpc.gov.ng/wp-content/uploads/2025/07/NDP-ACT-GAID-2025-MARCH-20TH.pdf
Source kind: Regulator guidance
Purpose: accountability_demonstration

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

Article 7 of the Directive lists the general compliance measures the Act expects of every data controller and data processor: registering with the Commission as one of major importance where the Commission so determines, conducting a compliance audit within fifteen months of commencing business and annually thereafter, filing Compliance Audit Returns by 31 March each year in the Ultra-High and Extra-High Level categories, identifying every obligation under the Act and scheduling compliance with it, keeping semi-annual data protection reports, and following schedules for monitoring, evaluating and maintaining the data security system and for internal sensitisation and training.

Article 9 governs registration as a data controller or data processor of major importance, requires the Ultra-High and Extra-High Level categories to register once and file Returns annually, requires the Ordinary-High Level category to renew registration annually instead, and requires notice to the Commission of any significant change to registered information within sixty days.

Articles 11 to 14 govern the designation, position, semi-annual reporting and credential assessment of the Data Protection Officer that section 32 of the Act mandates. Articles 15 to 17 and 20 to 26 carry the principles of section 24 and the lawful bases of section 25, and article 19 governs consent to cookies and other tracking tools.

Article 28 carries the Data Privacy Impact Assessment that section 28 of the Act mandates where processing may result in high risk, article 29 the monitoring, evaluation and maintenance of the data security system that section 39 requires, article 31 the duties that attach to deploying data processing software, and article 34 the Data Processing Agreement that section 29(2) requires between a controller and its processor.

The General Application and Implementation Directive 2025, which carries the text quoted here, is made under section 37 of the 1999 Constitution and sections 1(a), 6(c), 61 and 62 of the Nigeria Data Protection Act 2023, an Act in force since 12 June 2023.

When LexLint raises it

When your app profile says your app processes personal data.

Back to the example · Lint your app

Page updated 19 September 2026.