Nigeria Data Protection Act 2023

Section 2 gives the NDPA broad reach: it applies where the data controller or processor is domiciled, resident, or operating in Nigeria; where the processing occurs in Nigeria; and — extraterritorially — where a controller or processor not domiciled in Nigeria processes the personal data of data subjects in Nigeria. Africa's largest market therefore reaches foreign businesses serving Nigerian users. The General Application and Implementation Directive 2025, issued by the Nigeria Data Protection Commission on March 20, 2025 and effective September 19, 2025, is the operative compliance instrument: 52 articles and 10 schedules covering registration of data controllers and processors 'of major importance', Data Protection Officer requirements, annual audit filings, breach notification, cross-border transfer mechanisms, and consent standards. It supersedes the earlier NDPR 2019 and its 2020 Implementation Framework, which ceased to operate as data-protection regulation. Where the GAID and the Act conflict, the Act prevails.