Contributors: Okike-Osisiogu Barnabas, Antigha Okon (Interns)
INTRODUCTION
On the 14th of June 2023, President Bola Tinubu signed the Nigerian Data Protection Act (NDPA) 2023[1] into law. This marked a significant milestone in the protection of data rights in the digital age and was necessary to adapt to the increasing importance of personal data in today’s economy.
The Act established the Nigerian Data Protection Commission (NDPC) to replace the Nigeria Data Protection Bureau as the regulator of data protection in Nigeria[2]. The commission was empowered under Sections 61 & 62 of the Act to make regulations for carrying out its objectives. Pursuant to these powers, it released the Nigerian Data Protection Act General Application and Implementation Directives (GAID) 2025.
The GAID aims to guide the processing of personal information[3]. Consequently, it enhances understanding, application and compliance with the NDPA.
The GAID repeals the Nigerian Data Protection Regulation (NDPR) 2019 and the NDPR Implementation Framework 2020[4] and is scheduled to take effect on September 19, 2025.
This article offers a comprehensive examination of the GAID’s provisions, shedding light on their impact on data processors and data subjects and addressing its shortcomings, challenges, and limitations.
OVERVIEW OF THE GENERAL APPLICATION AND IMPLEMENTATION DIRECTIVE 2025
Scope and Applicability
The GAID clarifies that the NDPA applies to the following categories of data subjects:
(a) A data subject within the territory of Nigeria, (b)A data subject whose personal data has been transferred to Nigeria, (c) A data subject whose personal data is in transit through Nigeria and (d) A Nigerian citizen who is not within Nigeria[5]
OBLIGATIONS OF DATA CONTROLLERS AND PROCESSORS
The GAID clarifies and, in certain instances, enhances the obligations of data controllers and processors, which may be outlined as follows:
1. Duty of Care: It provides that every person, body, or authority owes a duty of care to data subjects to carefully examine the material context of personal data processing to ensure that it conforms to their right to privacy and the objectives outlined in the NDPA.[6]
2. Reliance on Exemptions: it provides that data controllers or processors relying on exemptions provided under Section 3 of the NDPA shall abide by other provisions not exempted by the NDPA. The exemptions provided under section 3 of the NDPA include processing of personal data solely for household or personal purposes, processing carried out by a competent authority in relation to criminal offences, public health emergencies, national security, and legal claims.
It provides that data processing activities exempted under these categories shall remain bound by the provisions of Sections 24, 25, 32, 40, and Part VI of the NDPA.
3. Data Processed for Household or Personal Purposes: Section 3 of the NDPA provides that the Act shall not apply to the processing of personal data solely for personal or household purposes, subject to certain exceptions. On this issue, the GAID clarifies that individuals who process data solely for personal or household purposes shall respect the privacy of a data subject and be held accountable for conduct that puts the privacy of a data subject at risk[7].
4. Compliance Requirements: Data controllers and processors are required to take certain measures to comply with the provisions of the NDPA. The GAID has spelled out 23 of such measures which include: a) Registration with the Commission as a data controller or data processor of major importance b) Conduct of an NDP Act compliance audit within Fifteen (15) months of commencement of business and on an annual basis thereafter; c) Provision of clear privacy and cookie notices on the home pages of their websites d) Establishing internal data protection strategies/policies and basic privacy checklists.[8]
5. Data Controllers and Consent: Article 16 of the GAID gives the data controller the ultimate responsibility for determining the lawful bases of data processing, one of which is consent. Regarding consent, the data processor relying on consent is obligated to keep a proper record that guarantees accountability in respect of the consent.
In determining whether a data controller is accountable in the mode of obtaining consent, the data controller is mandated to: a) Provide appropriate information to the data subject to ensure that the data subject makes an informed decision; b) Make the process of withdrawal of consent as easy as giving consent; and c) Ensure that refusal of consent is not detrimental to the rights and interests of the data subject[9]. The GAID also clarifies that the use of cookies or other tracking tools requires consent[10].
6. Legitimate Interest Assessment: Where a data controller elects to rely on legitimate interest as the lawful basis for processing, the GAID requires that a legitimate interest assessment be conducted to determine whether legitimate interest can serve as an adequate lawful basis for the data processing[11].
7. Data Processing Agreement: The NDPA provides that data controllers or processors who engage the service of another data controller or processor shall take measures to protect the data, including a written agreement between the parties. The GAID also specifies certain terms and conditions to be included in the agreement[12].
8. Use of Emerging Technologies: a data controller or a data processor who deploys or intends to deploy Emerging Technologies (ETs) such as Artificial Intelligence, Internet of Things and Blockchain to process personal data is expected to set forth technical and organisational parameters for the processing.
These parameters are to consider the right of a data subject not to be subject to a decision solely based on automated processes or algorithms, safeguards for processing of sensitive data, among others[13] and are to be filed as part of its compliance Audit Report.
9. Additional Obligations of Data Processors: Article 29 GAID requires data processors to have schedules for monitoring and maintenance of data security systems and prepare and implement an organisational schedule for internal sensitisation and training on privacy[14]. Data processors are also required to put in place appropriate technical and organisational measures to prevent the use of their platform to breach the privacy of a data subject[15].
CLASSIFICATION OF DATA CONTROLLERS AND PROCESSORS
The GAID designates a data controller as one of major importance if it keeps or has access to a filing system for the processing of data and in addition does either of the following: a) processes the data of more than 200 data subjects in 6 months b) carries out commercial ICT services on any device which has storage capacity for personl data and belongs to another individual c) processes data as an organisation or service provider in a numbers of sectors including education; electric power; export and import, financial, health, hospitality, insurance, oil and gas, tourism, e-commerce, public service[16].
The Commission classifies data controllers of major importance and data processors into three levels, namely: (a) Ultra-High Level (UHL), (b)Extra-High Level (EHL) and (c) Ordinary-High Level (OHL), depending on the nature of business and the amounts of data they process. [art 8(4)][17].
For registration, UHLs shall pay the sum of ₦250,000, EHLs shall pay ₦100,000, and OHLs shall pay ₦10,000. Data Controllers and processors in the UHL and EHL categories are also required to register once with the NDPC but must file Compliance Audit Reports (CAR) with the NDPC annually. However, those in the OHL category are not required to file a CAR with the NDPC.[18]
RIGHTS OF DATA SUBJECTS UNDER THE DIRECTIVE
1. Right to Rectification: The GAID provides that data subjects have the right to rectify their data. As such, data controllers or processors are to ensure that their platforms provide an effective opportunity for data rectification. Also, a data subject shall not be required to pay to correct an error that is not their fault[19].
2. Data Portability[20]: Data subjects have the right to transfer their data from one data controller/processor to another. Accordingly, the GAID provides that the right shall apply where the data was provided on the basis of consent or contract, but may not apply where the data was provided on other legal bases.
3. Erasure of Data[21]: A data subject also has the right to have his or her personal data erased. However, this right may be eroded where data is processed in the exercise of the right of freedom of expression and information. It may also be eroded where necessary in instances, such as: compliance with legal ruling or obligation, performance of a task in the public interest, for public health purposes and where the data is being used for the establishment of a legal defence or exercise of other legal claims.
4. Complaint: The GAID also provides that the data subject has the right to lodge a complaint with the Nigerian Data Protection Commission and requires the commission to set up an electronic platform for this purpose[22]. An aggrieved data subject may also issue a Subject’s Standard Notice to Address Grievance (SNAG) to a data controller or processor where the data subject reasonably believes that the data controller or processor violated his or her right to data privacy[23].
STRENGTHS OF THE GAID DIRECTIVE
The GAID 2025 makes noteworthy innovations which significantly improve the compliance mechanism, provide clear implementation guidelines and align the Nigerian Data Protection regime with international best practices.
- Enhanced Compliance Mechanisms
The directive introduces novel mechanisms designed to achieve its purpose. These mechanisms include mandating the registration of Data Controllers and Data Processors of Major Importance (DCPMI), the requirement of filing annual compliance audit Report and the classification of DCPMI. This enhances oversight of data management and ensures that entities with higher data processing volume face stricter oversight.
Secondly, it has strengthened the role of Data Protection Officers (DPOs). It has done this by among others, mandating data controllers or data processors of major importance to designate a DPO[24], requiring that the DPOs report directly to management[25]. Moreover, the Annual Credentials Assessment by the Commission[26] ensures continuous internal monitoring and professional development.
- Provision of Greater Clarity
The GAID has provided greater clarity and ensured consistency in the interpretation and application of the NDPA. It clarifies the principles of data protection by thoroughly defining each of the eight principles outlined in Section 24 of the NDPA. This offers data controllers and processors a comprehensive understanding of their obligations.
Article 16 enumerates the six lawful bases for data processing[27]. Subsequent articles[28] provide specific guidance on relying on each basis, including conditions for valid consent (Article 17), and detailed considerations for legitimate interest assessments (Article 26, Schedule 8).
The GAID recognises the need for data breach notification and provides a mechanism for such. It also details instructions and information to be contained in the breach notification, ensuring comprehensive reporting.
The GAID also provides comprehensive guidelines on cross-border data transfer[29] and outlines the criteria to evaluate the data protection level of a given country. This creates clarity for organisations involved in international data transfer.
- Alignment with International Best Practices
The GAID brings Nigeria’s data protection framework in line with global standards by affirming universal civil liberties[30], adopting a privacy-by-default approach, and emphasising core principles of data ethics.
Article 35 of the GAID also integrates Interoperable Data Privacy Measures (IDPMs), ensuring Nigeria’s data protection ecosystem is compatible with international norms and facilitating cross-border data flows.
Furthermore, Articles 41 and 42 elaborate on the principles of data ethics, such as organisational policy on data ownership, demonstrable transparency and accountability. These ethical considerations promote a responsible approach to data processing consistent with evolving global discussions on AI ethics and data governance.
WEAKNESSES AND GAPS OF THE GAID
- Ambiguities in Key Provisions
Unfortunately, some of the provisions of the GAID leave more questions than answers. First, the meaning of “Operating in Nigeria” still leaves room for confusion. While Article 8(2) clarifies “operating in Nigeria” to include “targeting” data subjects in Nigeria, it fails to clarify what constitutes “targeting”.
Secondly, determining “particular value or significance” for the DCPMI designation still requires clarification. While Article 8(3) lists factors for assessing “value or significance to the economy, society or security of Nigeria”, some of these factors, such as “implication for data sovereignty” or “substantial involvement in cross-border data flows”, could benefit from more quantitative benchmarks.
Additionally, Article 28(1) mandates a DPIA “when data processing may likely result in high risk to the rights and freedoms of a data subject”. While Article 28(3) outlines some examples of what constitutes high risk, a more detailed framework or criteria for assessing “high risk” is necessary to assist organisations in determining when a DPIA is necessary.
- Enforcement Challenges
Certain areas of the GAID could pose a challenge to its implementation and need to be addressed before the Directives become operational.
First, resource allocation for the Commission. In light of the significant responsibilities placed on the commission, adequate human and financial resources need to be dedicated to the NDPC to enable them to achieve these mandates and properly enforce the directives.
Cross-border enforcement poses another challenge. For example, enforcing the provisions of Section 5, which deals with foreign data controllers or processors not domiciled in Nigeria, might be difficult, especially those from countries without formal agreements with Nigeria. The “mutual legal assistance” provision in Article 1(4)(d)(i) may also be slow and complex.
Implementation of the Directive also requires technical expertise for emerging technologies. The Commission will need highly specialised technical expertise to assess, monitor, and regulate data processing involving complex and rapidly evolving technologies like AI and blockchain.
- Potential Conflicts with Existing Laws
Article 3(1) and 3(2) of the GAID state in line with Section 63 of the NDPA, that the Act prevails where its provisions are inconsistent with any other law relating to personal data processing. While this provision seems clear, challenges may arise in balancing regulatory requirements with existing laws in sectors such as the Banking and Health Sectors, where institutions are expected to deal with specific data in line with industrial regulations.
- Compliance Burden on SMEs
The Directive raises financial and administrative costs for Small and Medium Enterprises (SMEs). The tiered registration fees for DCPMI[31] and the requirement for annual CAR filings[32] and other requirements for documentation place a significant financial and administrative burden on SME’s under the “Ordinary-High Level” category. Also, most Nigerian SMEs lack dedicated privacy professionals or the resources to invest heavily in advanced data security systems.
Additionally, while Article 46 mandates capacity building for organisations, many SMEs in Nigeria lack the resources to fund such capacity-building programs for their employees.
RECOMMENDATIONS
To achieve its broader objectives, the weaknesses highlighted in this work need to be addressed. The following adjustments are hereby recommended;
- Refine Definitions for Clarity:
Terms highlighted that create ambiguity need to be clarified further by the Commission through a supplementary guidance paper.
Such terms include the phrase “Operating in Nigeria” and the term “High Risk” in Data Protection Impact Assessment (DPIA). These should be refined to provide more concrete examples, quantitative thresholds and a more detailed set of criteria for what constitutes them.
- Harmonise with Existing Laws and Regulators to Limit Burden on Businesses:
The NDPC should actively engage with other regulators to review existing laws relating to personal data processing, harmonise them with GAID and eliminate duplication and regulatory overlap.
- Strengthening Institutional Capacity of the NDPC
The effectiveness of the GAID largely rests on the Commission’s capacity to enforce its provisions. To achieve this, funding and manpower and the technological infrastructure of the commission must be increased.
There should also be specialised Training, Expertise and capacity-building sessions for the Commission’s staff in relevant areas, including emerging technologies (ETs), advanced data forensics and audit techniques.
- Public Awareness and Stakeholder Engagement
The success in the implementation of the GAID depends on broad public understanding and stakeholder participation from affected industry players. To achieve this, there needs to be;
This could be achieved through multilingual nationwide awareness campaigns aimed at educating data subjects, especially vulnerable groups identified in Schedule 6[33] , on their rights and how to identify and address violations. Also, the commission needs to actively engage data controllers and processors and liaise with data protection compliance organisations, encouraging them to offer affordable and accessible services to SMEs.
- Private Sector Compliance Strategies
Businesses should aim to integrate compliance into their operational framework. This includes hiring and training Data Protection Officers (DPOs) as required by Article 12(2)(c) and using the services of Data Protection Compliance Organisations (DPCOs).
Also, businesses are to integrate an inbuilt proactive data privacy infrastructure into their platforms[34]. And conduct DPIAs regularly.
Additionally, contracts must be properly drafted, analysed, and reviewed, especially those entered into with third-party processors[35].
Finally, steps should be taken to ensure the security of the digital platforms that process personal data. This includes regular training, tests, software patches, and strong encryption.
REFERENCE
- https://punchng.com/tinubu-signs-data-protection-bill-into-law/ (accessed on July 2025) ↑
- Section 4 NDPA 2023 ↑
- GAID 2025 preamble ↑
- Article 3(3) GAID ↑
- Article 1(4) ↑
- Article 2 NDPA ↑
- Article 6 GAID ↑
- Article 7 GAID ↑
- Article 17 GAID ↑
- Article 19 GAID ↑
- Article 26 GAID ↑
- Article 34 GAID ↑
- Article 43 GAID ↑
- Article 30 GAID ↑
- Article 32 GAID ↑
- Schedule 7 GAID ↑
- Schedule 7 GAID ↑
- Article 9 GAID ↑
- Art 36 GAID ↑
- Art 36 GAID ↑
- Art 38 GAID ↑
- Art 39 GAID ↑
- Art 40 GAID ↑
- Article 7(i) GAID ↑
- Article 12 GAID ↑
- Article 14 GAID ↑
- consent, contractual obligation, legal obligation, vital interest, public interest, and legitimate interest ↑
- Articles 17-26 GAID ↑
- Schedule 5 GAID ↑
- Article 1(3) of the GAID ↑
- Schedule 10 GAID ↑
- Article 10(6) GAID ↑
- e.g., minors, the elderly, individuals with digital literacy gaps ↑
- GAID Schedule 1, and Article 28(11) ↑
- NDPA Section 29(2) and GAID Article 34 ↑
