The Nigeria Data Protection Commission (NDPC) has unveiled a new regulatory framework to guide the implementation of the Nigeria Data Protection Act (NDP Act), 2023. This development follows the Presidential Assent granted by President Bola Ahmed Tinubu, GCFR, on June 12, 2023, marking a milestone in the country’s commitment to upholding the fundamental rights of its citizens in the digital age.
Following the enactment of the NDP Act, the Commission embarked on an extensive consultation process to establish a comprehensive implementation directive. In alignment with Section 37 of the Nigerian Constitution, which guarantees the privacy of citizens in their homes, correspondence, and communications, the NDPC has engaged with various stakeholders, including data subjects, government authorities, corporate entities, civil society organizations, international institutions, and the media.
To ensure an inclusive approach, the Commission inaugurated a National Committee on September 6, 2023, comprising technical experts and chaired by its Head of Legal, Enforcement, and Regulations. Tasked with drafting the NDP Act General Application and Implementation Directive (NDP Act GAID), the committee sought input through workshops, focus group discussions, and public consultations. Validation workshops held in Lagos on June 19, 2024, and in Abuja on August 21, 2024, further refined the framework, culminating in the release of the NDP Act GAID, 2025.
The newly introduced directive covers critical areas such as data protection principles, lawful data processing, data subject rights, compliance audits, cross-border data transfer, emerging technologies, and accountability measures. Notably, the framework emphasizes privacy considerations in the realm of artificial intelligence (AI) and mandates a “privacy by design and by default” approach for organizations handling sensitive data.
A key feature of the NDP Act GAID is the introduction of the Standard Notice to Address Grievance (SNAG), which empowers individuals to seek redress directly from data controllers and processors without requiring prior intervention from the Commission. With this mechanism, over 230 million Nigerians can actively participate in ensuring compliance with data protection laws. The process is set to be automated, making it accessible nationwide and globally.
Holding data controllers and processors accountable is a cornerstone of the directive, reinforcing public trust in lawful data usage while fostering sustainable development. The NDPC has reaffirmed its commitment to an open-door policy that prioritizes fairness, economic growth, and regulatory transparency. With the issuance of the NDP Act GAID, organizations are now expected to comply fully with their legal obligations, eliminating any claims of ignorance regarding data protection laws.
The Commission expressed gratitude for the continued support from the Federal Government, led by President Tinubu, and the Federal Ministry of Communications, Innovation, and Digital Economy under Dr. Bosun Tijani. The collaborative efforts of stakeholders, both within and outside Nigeria, have been instrumental in shaping the regulatory landscape.
The full implementation of the NDP Act is scheduled to commence in September 2025, allowing a six-month transition period. Additionally, provisions related to fees will take effect from January 2026. Moving forward, the NDPC will issue guidance notices, advisories, and capacity-building programs to further enhance compliance and foster a culture of data privacy. The Commission remains open to feedback, which will inform future regulatory updates and initiatives in the evolving data protection ecosystem.
