Who the Act applies to
The Nigeria Data Protection Act, 2023 applies to processing of personal data by controllers and processors domiciled or operating in Nigeria, and to those outside Nigeria who process the personal data of data subjects in Nigeria. The NDPC's General Application and Implementation Directive (GAID) sets out how the Act is applied in practice.
The core obligations
| Obligation | Where in the Act |
|---|---|
| Processing principles: fairness, purpose limitation, minimisation, accuracy, storage limitation, security | Section 24 |
| A lawful basis for every processing activity, including consent | Section 25 |
| Data protection impact assessment for high-risk processing | Section 28 |
| Data protection officer for data controllers of major importance | Section 32 |
| Rights of data subjects, including access, rectification, erasure and objection | Sections 34 to 38 |
| Security and breach notification within 72 hours | Sections 39 and 40 |
| Conditions for cross-border transfers | Sections 41 to 43 |
| Registration of data controllers and processors of major importance | Section 44 |
Data controllers of major importance
The Act imposes extra duties on data controllers and processors of major importance: those the NDPC designates by the volume or sensitivity of the data they process, or their value to the economy. They must register with the NDPC, appoint a DPO and, under the GAID, file annual compliance audit returns.
Penalties
Under section 48, the NDPC can impose a remedial order and a penalty. For a data controller or processor of major importance, the higher maximum is the greater of ₦10 million or 2% of annual gross revenue in the preceding financial year. For others, the standard maximum is the greater of ₦2 million or 2% of annual gross revenue.
hlola loads the NDPA's controls for Nigerian entities, with the 72-hour breach clock and rights deadlines built in. See the NDPA in hlola.
Common questions
Did the NDPA replace the NDPR?
The Nigeria Data Protection Act, 2023 is now the primary law. The NDPC's General Application and Implementation Directive sets out how it is applied; the NDPR remains relevant only where it is consistent with the Act.
Who enforces the NDPA?
The Nigeria Data Protection Commission (NDPC), established by the Act.
What is the maximum NDPA fine?
For data controllers and processors of major importance, the greater of ₦10 million or 2% of annual gross revenue; for others, the greater of ₦2 million or 2% of annual gross revenue.
This guide explains the law in general terms and is not legal advice. Laws, regulations and regulators' guidance change; confirm how they apply to your organisation with qualified counsel. Last reviewed 25 October 2026.