NDPA 2023
Market regime · Nigeria Data Protection Act 2023
Federal Republic of Nigeria / NDPC
Nigeria
Act signed June 2023; GAID 2025 operationalising
Nigeria Data Protection Commission (NDPC)
Any organisation processing personal data of people in Nigeria
Curated, versioned & cross-mapped
The obligation, plainly.
The NDPA is the closest thing Nigeria has to a universal compliance obligation: process personal data and it applies, whatever your industry. It established the NDPC as regulator, and the GAID 2025 directive is filling in the operational detail.
Its demands will be familiar from GDPR: lawful bases, data-subject rights, breach notification, impact assessments for high-risk processing, and accountability for the processors you use. The difference is enforcement posture: the NDPC is young, active and building its case book.
Where programmes are tested.
Lawful processing and rights
A basis for every processing activity, and rights requests answered within the statutory windows.
Breach notification
72 hours to notify the NDPC of a qualifying breach, with the assessment evidenced.
Accountability
DPO designation where required, impact assessments, records of processing and processor due diligence.
Curated once, evidenced continuously.
- NDPA obligations are curated and cross-mapped to GDPR and ISO 27001 controls, with breach clocks tracked automatically in the Incident module.
- Requirements resolve to shared controls: implement a control once and it counts toward every framework it maps to.
- Status is evidence-gated: a requirement can't be marked implemented without valid, in-date evidence behind it.
- Every attestation carries maker/checker, and every action lands in an append-only audit trail.
NDPA 2023, asked plainly.
The questions compliance teams actually ask before an adoption decision or an audit.
Who does the NDPA apply to?
Any organisation processing the personal data of people in Nigeria, in any industry, plus organisations outside Nigeria processing the data of Nigerian residents. It is the closest thing the country has to a universal compliance obligation.
What is the NDPA breach notification deadline?
72 hours to notify the NDPC of a breach likely to risk individuals' rights and freedoms, with affected data subjects informed where the risk is high. The assessment behind notify-or-not must itself be evidenced, which is why breach clocks belong inside the incident workflow.
Do we need a data protection officer?
Controllers designated as being of major importance must appoint one and register with the NDPC; others should assign responsibility deliberately even where the formal duty does not bite. The GAID 2025 directive is sharpening these operational thresholds.
What are the penalties under the NDPA?
For data controllers of major importance, up to the higher of ₦10 million or 2% of annual gross revenue; lower thresholds apply to other controllers. The NDPC is young but active, and its enforcement case book is growing.
Where it connects.
The full catalogCompliance you can prove.
Walk into your next audit ready.
Book a working demo. We'll map your obligations to the standards you're audited against and the regulators you actually answer to.
The platform, modules, catalog, audit trail and security architecture are live today; the continuous live-evidence engine is in active development, shown in a working demo. Reach us at hello@cardinalgrc.com.