🇳🇬General Application and Implementation Directive

← Back to laws in Nigeria

The implementation manual for Nigeria's Data Protection Act

The Nigeria Data Protection Act General Application and Implementation Directive, commonly referred to as GAID, is the practical bridge between the NDPA and day-to-day compliance. It does not replace the Act. It explains how the Commission expects controllers and processors to apply the Act across lawful basis, transparency, major data processing, audits, DPO governance, DPIAs, breach notification, data processing agreements, cross-border transfers and evidence of compliance.

For organisations, GAID is often the most useful operational document in the Nigerian framework. The NDPA tells you the legal duties. GAID tells you what proof, process, classifications, schedules and reports the Commission expects to see.

Scope and priority

Article 1 explains that section 2(c) of the NDPA applies to data controllers and processors not domiciled in Nigeria where they process personal data of data subjects in Nigeria or target Nigerian data subjects. It also identifies categories of protected data subjects, including persons within Nigeria, personal data transferred to Nigeria, data in transit through Nigeria in limited respects, and Nigerian citizens outside Nigeria in certain circumstances.

Article 3 addresses conflicts and multiple regulatory frameworks. It relies on section 63 of the NDPA: where another law or enactment directly or indirectly relates to personal data processing and is inconsistent with the Act, the Act prevails. GAID also states that upon its issuance, the Commission ceases to apply the NDPR 2019 as the legal instrument for regulating data privacy and protection, without affecting things already done under the NDPR before GAID.

General compliance measures

Article 7 sets out the baseline compliance expectations. A controller or processor should register with the Commission as a controller or processor of major importance where required, conduct a compliance audit within 15 months of commencement of business and annually thereafter, file compliance audit returns where required, identify obligations under the Act, prepare compliance schedules, maintain semi-annual data protection reports, implement monitoring, evaluation and maintenance schedules for security, conduct internal training, designate a DPO where required, and develop or review privacy policies.

GAID is particularly direct about transparency. Privacy policies should be published on relevant platforms and privacy and cookie notices should be provided where processing takes place. Cookie notices must give the data subject an opportunity to decline or accept; hiding a notice at the bottom of a webpage may be treated as a transparency failure.

Major data processing and registration

Article 8 explains how the Commission assesses controllers and processors of major importance. The Commission considers risk to data subjects, data sovereignty implications, sensitivity of data, data-driven financial assets, reliance on cloud or third-party servers, substantial cross-border flows, automation, number of data subjects and the need for international standard certifications around confidentiality, integrity and availability.

GAID classifies major data processing into Ultra-High Level, Extra-High Level and Ordinary-High Level. Article 9 then addresses registration. UHL and EHL entities register once and file annual compliance audit returns. OHL entities renew registration annually and are not required to file annual CAR when they renew annually. Significant changes to registration information must be notified to the Commission within 60 days.

DPO governance

Articles 11 to 14 explain the DPO framework. Section 32 of the NDPA mandates DPO designation in relevant cases. The DPO may be a staff member or may act under a service contract. The controller or processor must publish the DPO's contact details and communicate them to the Commission.

The DPO must be actively involved in all issues relating to personal data processing. GAID requires support, resources, access to processing activities, continuous training, protection from coercion or penalty, and direct reporting to management. Data subjects must be able to contact the DPO regarding processing and the exercise of their rights.

Lawful basis, information and DPIA

GAID gives detailed direction on lawful bases. It distinguishes consent, contract, legal obligation, vital interest, public interest and legitimate interest. Consent must be used only where required and must be requested separately after the data subject has received the information needed to make an informed decision.

Article 27 sets out information that should be provided to data subjects, including the controller or processor name, lawful basis, data types, purpose, means of processing, third-party access, data subject rights, internal remediation contact and the right to complain to the Commission.

Article 28 deals with DPIAs. A DPIA is required where processing is likely to result in high risk to rights and freedoms because of its nature, scope, context or purpose. This is especially important for behavioural monitoring, profiling, emerging technologies, vulnerable data subjects, high-volume processing and processing that may affect dignity or fundamental rights.

Breach notification, data processing agreements and transfers

GAID requires a structured breach notification process. Controllers and processors need internal escalation, assessment of breach impact, documentation and communication with the Commission where required. Breach handling should be tied to monitoring, evaluation and maintenance of the data security system.

GAID also requires data processing agreements and gives direction on processor governance. Contracts should not merely appoint a vendor. They should define instructions, confidentiality, assistance with data subject rights, security, sub-processing, audit support, deletion or return of data and breach responsibilities.

Article 45 and Schedule 5 provide guidance on cross-border transfers. Transfer analysis should consider adequacy, safeguards, contracts, risk, data subject rights and the Commission's expectations. Cross-border processing cannot be treated as a pure procurement decision.