CevroNigeria: Nigeria Data Protection Act (NDPA) 2023 and what it requires
Nigeria Data Protection Act (NDPA) 2023: an established law with an active enforcement record. Overseen by Nigeria Data Protection Commission (NDPC).
Key requirements at a glance
| Registration with the regulator | Depends on thresholds or circumstances |
|---|---|
| Data protection officer | Depends on thresholds or circumstances |
| Breach notification | Within 72 hours |
| Cross-border transfer restrictions | Required |
| Data localization | Not required |
Penalties and enforcement
Up to 2% of annual gross revenue or ₦10,000,000, whichever is greater.
What to know in practice
Registration and DPO designation apply once a controller/processor crosses the Data Controller/Processor of Major Importance (DCPMI) threshold; an annual Compliance Audit Return is then required.
How Cevro helps
- Maps Nigeria Data Protection Act (NDPA) 2023 to the rest of your compliance program, so evidence collected for SOC 2 or ISO 27001 also counts here where it overlaps.
- Includes a dedicated NDPA workspace for registration, data protection officer, impact assessment and breach-notification tracking.
- Gives every failing control a specific fix and a way to re-check it.
Frequently asked questions
Who regulates data protection in Nigeria?
Nigeria Data Protection Commission (NDPC) oversees Nigeria Data Protection Act (NDPA) 2023.
Is breach notification mandatory under Nigeria Data Protection Act (NDPA) 2023?
The law sets a 72-hour window for notifying the regulator of a personal data breach, so you need detection and an incident process that can meet it.
Does Nigeria restrict cross-border data transfers?
Yes. Moving personal data out of Nigeria is restricted, so confirm a lawful transfer basis before data leaves the jurisdiction.
Do you need a data protection officer under Nigeria Data Protection Act (NDPA) 2023?
Only in some cases, usually depending on the scale or sensitivity of your processing. Confirm whether you cross the threshold.
What are the penalties for non-compliance in Nigeria?
Up to 2% of annual gross revenue or ₦10,000,000, whichever is greater.