The Nigeria Data Protection Commission, NDPC, has issued a regulatory instrument known as NDP Act GAID, to address technical and organisational measures in the Nigerian data ecosystem.
The instrument will address the following areas: Data Protection Principles, Lawful Bases of Data Processing, Data Subjects’ Rights, Material and Territorial Scope of the NDP Act, Data Ethics, Emerging Technologies, NDP Act Compliance Audit Returns, Data Privacy Impact Assessment, Cross-border Data Transfer, Training and Certification of Data Protection Officers, Benchmarking with global best practice, Cooperation and Collaboration, Alternative Dispute Resolution, and Standardised Grievances Redress Mechanism.
In a press statement titled Issuance of Nigeria Data Protection Act-General Application and Impementation Directive ( NDP ACT -GAID) 2025 issued on Tuesday 20th, 2025 the National Commissioner, Dr Vincent Olatunji said the instrument was issued to hold data controllers and data processors accountable for their acts and omissions which affects the rights of others cannot be gainsaid. This accountability creates trust for the lawful use of data towards achieving sustainable development.
Olatunji said the Commission was committed to this objective of the NDP Act and its open-door policy to ensure that all stakeholders are given equal and equitable opportunity in a manner that respects the rights of individuals and fosters economic growth in Nigeria – for the benefit of all Nigerians.
“Today’s event is another milestone in Nigeria’s quest towards safeguarding the fundamental rights and freedoms of Nigerians in the context of data privacy and protection as we push in the frontiers of the 4th Industrial Revolution”, he said.
The National Commissioner said the issuance of the instrument follows the Presidential Assent to the Nigeria Data Protection Bill by President Bola Ahmed Tinubu on the 12th of June, 2023, which led Nigeria Data Protection Commission to begin the process of putting in place a robust implementation directive which will give effect to the noble objectives of the Nigeria Data Protection Act, 2023.
Olatunji said the historic Presidential Assent is in fulfilment of Section 37 of the Constitution of the Federal Republic of Nigeria, 1999 (As Amended) and that Nigeria desires under this provision that: the privacy of citizens, their homes, correspondence, telephone conversations and telegraphic communications should be guaranteed and protected.
The Commission engaged several stakeholders as part of its constitutional obligation and in line with the Presidential Priority on Rule of Law (Improving Governance for Effective Service Delivery) to arrive at the drafting of the instrument.
It will be recalled that, on the 6th of September 2023, the Commission inaugurated a National Committee of technical experts drawn from the ecosystem and chaired by the Commission’s Head of Legal, Enforcement and Regulations. The mandate of the Committee was to draft the NDP Act General Application and Implementation Directive (NDP Act GAID).
The Committee received both written and oral commentaries through various workshops, focus group discussions and through our various communication channels. The Commission held a validation workshop in Lagos on the 19th of June, 2024 and another one was held in Abuja on the 21st of August 2024. These engagements created a rich frame of reference in drafting the NDP Act-GAID, 2025.
Olatunji noted that ” the quest for safeguarding privacy rights in the context of emerging technologies such as Artificial Intelligence received attention in the NDP Act GAID. Practitioners in this space are enjoined to implement privacy by design and by default among other obligations. Furthermore, we have fully democratised privacy breach remediation process for data subjects.
“We achieved this by introducing data subjects’ Standard Notice to Address Grievance (SNAG) which empowers data subjects to use the instrumentality of the Commission to demand remedial action from data controllers and processors without first writing to the Commission. This process makes over 230 million Nigerians our immediate and direct partners in ensuring adequacy of data protection in Nigeria. Through Automation, the SNAG will be accessible anywhere in all nooks and crannies of Nigeria and around the world.
“Essential to this economic growth is accountability of players who feel called upon to deal in the personal data of citizens in a manner that may appear to go beyond the confines of the law.
“Be that as it may, we are delighted to note that our remedial engagements with Nigerian organisations are yielding positive results gradually. With the issuance of the NDP Act GAID, no organisation can feign ignorance of its obligations under the law.
“The Commission expresses its most profound gratitude for the invaluable support it has been receiving in order to deliver on its mandate. First, to the Federal Government under the visionary leadership of His Excellency, President Bola Ahmed Tinubu, GCFR. The Hon. Minister of the Federal Ministry of Communications, Innovation and Digital Economy, Dr. Bosun Tijani, members and the secretariat of the NDP Act GAID Committee and, indeed, all our partners within and outside Nigeria.
” In line with Federal Government’s policy on Enabling Business Environment, the full implementation of the NDP Act will commence in September 2025 – that is after 6 months. Furthermore, all provisions relating to fees will commence in January 2026.
Olatunji said “Going forward, we shall be providing guidance notices and advisories to illustrate the requirements of law towards deepening the culture of data privacy and protection. We shall also be carrying out various capacity building programmes. In addition, we shall be taking feed-backs through our platforms. This will help the Commission in future reviews of the NDP Act GAID and in the issuance of new regulatory instruments. To this end, we propose to use our best endeavours”.
