🇳🇬Nigeria

Nigeria now has a layered data protection framework

Nigeria's privacy framework is no longer a single-instrument story. It has moved from a regulator-issued regulation under NITDA, to a dedicated national statute, to a detailed implementation directive issued by the Nigeria Data Protection Commission. The result is a layered system: the Nigeria Data Protection Act, 2023 is the primary legal framework; the General Application and Implementation Directive operationalises many obligations; the earlier Nigeria Data Protection Regulation 2019 remains important historically and transitionally; and sectoral laws such as the Child's Right Act and National Health Act shape child and health data handling.

The framework is built around Nigeria's constitutional right to privacy, the need to regulate personal data processing across the digital economy, and the creation of the Nigeria Data Protection Commission as the central supervisory authority. For organisations, the practical point is direct: privacy compliance in Nigeria is now an operating model, not a one-page policy.

The three pillars to understand first

The Nigeria Data Protection Act, 2023 is the anchor law. It establishes the Nigeria Data Protection Commission, sets out principles and lawful bases for processing, recognises data subject rights, regulates data controllers and processors of major importance, and provides the main statutory basis for enforcement.

The GAID translates the Act into implementation expectations. It explains territorial application, compliance audits, registration as a controller or processor of major importance, DPO appointment, lawful basis assessment, privacy notices, DPIAs, breach notification, data processing agreements, cross-border transfer guidance and evidence of compliance.

Sectoral privacy rules still matter. The Child's Right Act protects the privacy, dignity, welfare and best interests of children, including restrictions around child court proceedings and publication of identifying information. The National Health Act governs health records, confidentiality, user information and the protection of health information within Nigeria's health system.

How the instruments work together

The NDPA is the primary rulebook for personal data processing. Where another law or instrument relates directly or indirectly to the processing of personal data and is inconsistent with the Act, the Act prevails. That makes the NDPA the reference point for resolving overlap between general privacy duties, sectoral frameworks, and prior administrative instruments.

The NDPR 2019 should be read as the foundation that shaped Nigeria's earlier data protection practice: privacy policies, lawful processing, consent, security, third-party processing contracts, data subject objections, foreign transfers and penalties. The GAID now states that, upon its issuance, the Commission ceases to apply the NDPR as the legal instrument for regulating data privacy and protection, while preserving things already done under the NDPR before GAID.

For compliance teams, the country page should therefore be read in sequence: start with the NDPA, use GAID for implementation detail, understand the NDPR for legacy compliance and transition history, and apply CRA/NHA rules where child data or health data are involved.

What organisations should prioritise

Start with a data map and lawful basis analysis under the NDPA. Every processing activity should have a documented purpose, lawful basis, category of data subject, category of personal data, retention position, security controls and transfer assessment. The lawful basis should not be retrofitted after the system is already deployed.

Next, determine whether the organisation is a data controller or processor of major importance. GAID introduces Ultra-High, Extra-High and Ordinary-High levels of major data processing, with registration, audit return and compliance reporting implications. Organisations that process large volumes, sensitive data, financial data, cross-border flows, cloud-based systems or data with significant impact on Nigeria's economy, society or security should treat this assessment as a formal governance task.

Finally, handle special contexts carefully. Child data requires best-interest thinking and careful parental/guardian and publication controls. Health data requires confidentiality, record protection and access controls under health-sector law as well as NDPA obligations. A privacy programme that ignores these sectoral overlays will remain incomplete.