CYBERSECURITY, PRIVACY & DATA PROTECTION

Introduction

In an era where data is the new oil, protecting personal information has become both a legal obligation and a strategic imperative. Nigeria’s data protection landscape has undergone a transformative shift with the enactment of the Nigeria Data Protection Act (NDPA) 2023 and the issuance of the General Application and Implementation Directive (GAID) 2025, which took full effect on 19 September 2025 .

The GAID represents a significant milestone as the first official implementation guideline under the NDPA, designed not just as a legal document but as a practical roadmap for organizations looking to embed data protection into their day-to-day operations . It consolidates how the Act applies in practice and introduces detailed rules on cross-border transfers, registration of data controllers and processors of major importance (DCMIs/DPMIs), and enhanced Data Protection Officer requirements .

For many Nigerian business owners, the digital transformation of commerce has been a double-edged sword. While technology opens new markets and efficiency gains, it also exposes businesses to growing cyber threats and regulatory obligations . This comprehensive guide examines cybersecurity, privacy, and data protection in Nigeria, covering the regulatory framework, key compliance obligations, enforcement powers, and practical steps for building a robust data protection program.

The Pain Points: Why Data Protection Matters Now More Than Ever

The Regulatory Transition Challenge

The GAID has repealed the Nigeria Data Protection Regulation (NDPR) 2019 and its Implementation Framework 2020 . Organizations that had previously aligned their processes and policies with the NDPR must now ensure those processes and policies are updated to reflect the NDPA-GAID positions . This transition creates significant compliance complexity for businesses that had built their data protection frameworks around the old regime.

The Extraterritorial Reach

The NDPA and GAID apply not only to entities domiciled in Nigeria but also foreign entities that target Nigerian data subjects . This extraterritorial scope means that any organization processing the personal data of Nigerian citizens—regardless of where the organization is based—must comply with Nigerian data protection law.

The Compliance Burden

The GAID introduces extensive compliance obligations, including mandatory registration for DCMIs/DPMIs, annual compliance audits, semi-annual data protection reports, and strict Data Protection Officer requirements . Organizations must also implement technical and organizational measures, maintain processing records, and display prominent privacy and cookie notices .

The Penalty Risk

The NDPC has statutory powers to investigate, issue compliance orders, and impose fines. Data controllers and processors can be fined up to ₦10,000,000 or 2% of the preceding year’s gross revenue (whichever is greater) . These penalties underscore the importance of proactive compliance.

The Incident Response Gap

Many Nigerian businesses lack formal incident response plans. When a cyber incident occurs—whether a data breach, ransomware attack, or insider threat—the lack of a structured response can turn a manageable incident into a crisis. Incident response planning is essential for detecting, responding to, and recovering from security breaches .

The Regulatory Framework

Nigeria Data Protection Act (NDPA) 2023

The NDPA is Nigeria’s primary legislation on data protection, administered by the Nigeria Data Protection Commission (NDPC) . It establishes the legal framework for the processing of personal data and safeguards the fundamental right to privacy.

Key Provisions:

• Material and Territorial Scope: The Act applies to all processing of personal data of data subjects in Nigeria, including foreign entities targeting Nigerian data subjects

• Data Subject Rights: The Act grants data subjects rights to access, correct, update, and transfer their personal data

• Lawful Bases for Processing: Processing is lawful only if based on consent, contract, legal obligation, vital interests, public interest, or legitimate interests

General Application and Implementation Directive (GAID) 2025

The GAID, issued on 20 March 2025, provides operational detail for implementing the NDPA . It is divided into 52 Articles and 10 Schedules .

Key Highlights:

• Repeal of NDPR: The NDPR 2019 and its Implementation Framework 2020 cease to be operational as data protection regulation

• Effective Date: 19 September 2025, following a six-month transition period

• Enhanced DPO Requirements: New provisions on DPO qualifications, functions, and credential assessment

• Data Subject Notice to Address Grievance (SNAG): A mechanism allowing data subjects to seek redress directly from data controllers and processors

Key Compliance Obligations

1. Registration of DCMIs/DPMIs

Organizations classified as Data Controllers or Data Processors of Major Importance (DCMIs/DPMIs) must register with the NDPC . The GAID classifies DCMIs/DPMIs into three levels :

2. Data Protection Officer (DPO)

DCMIs/DPMIs are required to designate a Data Protection Officer with expert knowledge of data protection law and practices .

Key DPO Requirements:

• Independence: DPOs must be protected from coercion, undue influence, or retaliatory actions

• Semi-Annual Reports: DPOs must prepare and submit a semi-annual data protection report to management

• Annual Credential Assessment: DPOs must undergo an Annual Credential Assessment by the Commission and attain a minimum of 40 CPD training hours annually

3. Compliance Audit Returns (CAR)

All data controllers and processors must conduct a compliance audit within 15 months of commencing business and annually thereafter . DCMIs in the UHL and EHL categories must file their CAR with the NDPC by 31 March each year .

4. Privacy and Cookie Notices

The GAID introduces stricter requirements for privacy and cookie notices :

• Prominent Publication: Notices must be prominently published on the homepage of websites

• Clear Option: Data subjects must have a clear option to accept or decline cookies

• Visibility: Cookie notices should significantly obstruct part of the screen; placing them at the bottom where they may go unnoticed could be deemed a lack of transparency

5. Data Breach Notification

Data controllers must notify the NDPC within 72 hours of becoming aware of a breach likely to risk individuals’ rights or freedoms . If a breach is likely to result in high risk, affected individuals must be notified without undue delay .

6. Cross-Border Data Transfers

As a general rule, personal data can only be transferred out of Nigeria where the recipient is subject to a binding law or mechanism that affords an adequate level of protection . The GAID operationalizes mechanisms familiar to GDPR, including adequacy determinations, binding corporate rules, standard contractual clauses, codes of conduct, and certifications .

7. Data Retention Rules

Personal data must be deleted within six months once its original purpose is complete, unless there is a legal justification for retaining it .

8. Data Protection Impact Assessments (DPIAs)

DPIAs are required for high-risk processing activities, including profiling, automated decision-making, systematic monitoring, and processing of sensitive data .

Building an Effective Cybersecurity Program

Incident Response Planning

Incident response planning is essential for detecting, responding to, and recovering from security breaches. A formal incident response plan should include :

• Detection: Processes for identifying security incidents

• Containment: Steps to limit the impact of an incident

• Eradication: Removing the threat from the environment

• Recovery: Restoring systems and data

• Lessons Learned: Post-incident review to improve future response

Employee Training and Awareness

Employees are often the weakest link in cybersecurity. Regular training on phishing awareness, password hygiene, data handling, and incident reporting is essential. A culture of security awareness reduces the risk of human error leading to breaches.

Third-Party Risk Management

Organizations increasingly rely on third-party vendors and service providers. Managing third-party risk involves :

• Due Diligence: Assessing the security posture of vendors before engagement

• Contractual Protections: Including data protection and security clauses in contracts

• Ongoing Monitoring: Regularly reviewing vendor security practices

Technical Controls

Technical controls form the foundation of cybersecurity. Key controls include:

• Access Controls: Ensuring only authorized users can access systems and data

• Encryption: Protecting data at rest and in transit

• Network Security: Firewalls, intrusion detection, and secure configurations

• Endpoint Protection: Antivirus, anti-malware, and device management

• Backup and Recovery: Regular backups and tested recovery procedures

Intellectual Property Protection

Beyond personal data, businesses must protect their intellectual property—trade secrets, proprietary processes, customer lists, and other confidential information. This involves :

• Identification: Cataloging IP assets

• Protection Measures: NDAs, access controls, and security measures

• Monitoring: Detecting and responding to IP theft

Enforcement and Penalties

The NDPC has statutory powers to investigate, issue compliance orders, and impose fines .

Penalties:

• Fines: Up to ₦10,000,000 or 2% of the preceding year’s gross revenue (whichever is greater)

• Compliance Orders: The NDPC can issue orders requiring organizations to take specific actions to achieve compliance

• Registration Fees: DCMIs in the UHL category processing personal data of more than 50,000 data subjects face filing fees up to ₦1,000,000

How Qeeva Advisory Helps with Cybersecurity, Privacy & Data Protection

At Qeeva Advisory, we understand that navigating Nigeria’s evolving data protection landscape can be complex. Our team of experienced professionals helps Nigerian and international businesses achieve compliance with the NDPA and GAID.

Our Core Services

Advisory Services Nigeria – Our advisory professionals help you understand your data protection obligations, assess your compliance posture, and develop compliance strategies.

Regulatory Compliance – We ensure your data protection practices meet all regulatory requirements under the NDPA and GAID, including registration, audit filing, and breach notification.

Risk Management – We help you identify and manage data protection risks, including breach risks, cross-border transfer risks, and regulatory compliance risks.

Internal Control Advisory Service – We help you build robust internal controls for data protection, including access controls, data security measures, and breach response procedures.

Bookkeeping Services – Accurate records are essential for data protection compliance. Our bookkeeping services ensure your records are accurate and complete.

Our Service Methodology for Data Protection Compliance

At Qeeva Advisory, we follow a structured, collaborative process to deliver high-impact data protection solutions.

Phase 1: Information Security and Data Protection Assessment

Objective: Understand your current data protection posture and identify compliance gaps.

What We Do:

• Review your data processing activities and data flows

• Assess your compliance with NDPA and GAID requirements

• Evaluate your DPO arrangements and governance structures

• Review your privacy policies, notices, and consent mechanisms

• Identify gaps in registration, audit filing, and breach response

• Assess your incident response capabilities and third-party risk management

Deliverables:

• Data Protection Assessment Report

• Compliance gap analysis

• Priority action plan

Phase 2: Data Protection Framework Design

Objective: Develop a comprehensive data protection framework tailored to your organization.

What We Do:

• Design or refine privacy policies and notices

• Develop data protection governance structures

• Create data retention and deletion policies

• Establish breach response procedures

• Design cross-border transfer mechanisms

• Develop incident response plans

Deliverables:

• Data protection framework documentation

• Privacy policies and notices

• Breach response plan

• Incident response plan

• Data retention policy

Phase 3: Implementation Support

Objective: Implement data protection frameworks and build organizational capability.

What We Do:

• Support registration with the NDPC

• Assist with DPO appointment and training

• Implement consent management systems

• Conduct Data Protection Impact Assessments

• Train staff on data protection obligations

• Implement technical controls and security measures

Deliverables:

• NDPC registration support

• DPO training program

• DPIA reports

• Staff training materials

• Technical control implementation

Phase 4: Monitoring and Continuous Improvement

Objective: Ensure sustained compliance and continuous improvement.

What We Do:

• Conduct annual compliance audits

• Prepare Compliance Audit Returns

• Monitor regulatory changes and update frameworks

• Review data protection performance

• Provide ongoing advisory support

Deliverables:

• Annual compliance audit reports

• Compliance Audit Returns

• Regulatory update alerts

Frequently Asked Questions

Q: What is the Nigeria Data Protection Act (NDPA) 2023?
A: The NDPA is Nigeria’s primary legislation on data protection, administered by the Nigeria Data Protection Commission (NDPC). It establishes the legal framework for processing personal data and safeguards the fundamental right to privacy .

Q: What is the GAID 2025?
A: The General Application and Implementation Directive (GAID) 2025 is an operational rulebook issued by the NDPC to provide detailed guidance on implementing the NDPA. It took full effect on 19 September 2025 .

Q: Does the NDPR 2019 still apply?
A: No. The GAID has repealed the NDPR 2019 and its Implementation Framework 2020. The NDPA and GAID are now the operative provisions for data protection in Nigeria .

Q: What are the penalties for non-compliance?
A: Data controllers and processors can be fined up to ₦10,000,000 or 2% of the preceding year’s gross revenue (whichever is greater) .

Q: Who needs to register with the NDPC?
A: Organizations classified as Data Controllers or Data Processors of Major Importance (DCMIs/DPMIs) must register with the NDPC. The GAID classifies DCMIs into Ultra-High, Extra-High, and Ordinary-High levels based on the number of data subjects processed .

Q: What are the DPO requirements?
A: DCMIs/DPMIs must designate a DPO with expert knowledge. DPOs must prepare semi-annual reports, undergo Annual Credential Assessment, and attain a minimum of 40 CPD training hours annually .

Q: What is the breach notification timeline?
A: Data controllers must notify the NDPC within 72 hours of becoming aware of a breach likely to risk individuals’ rights or freedoms .

Q: How does the NDPA apply to foreign companies?
A: The NDPA applies to foreign entities that target Nigerian data subjects. This extraterritorial scope means any organization processing the personal data of Nigerian citizens must comply with Nigerian data protection law .

Q: What should an incident response plan include?
A: An incident response plan should include processes for detection, containment, eradication, recovery, and lessons learned. It should be tested regularly and updated as threats evolve .

The Bottom Line

Cybersecurity, privacy, and data protection are no longer optional—they are legal obligations and strategic imperatives for any organization processing personal data in Nigeria. The NDPA 2023 and GAID 2025 establish a comprehensive framework that demands proactive compliance.

Key Takeaways:

Understand the Regulatory Framework: The NDPA 2023 is the primary legislation, and the GAID 2025 provides operational detail. The NDPR 2019 has been repealed .

Register if Required: DCMIs/DPMIs must register with the NDPC and comply with audit and reporting obligations .

Appoint a DPO: DCMIs/DPMIs must designate a qualified DPO with independence and resources to perform their duties .

Implement Breach Response: Data controllers must notify the NDPC within 72 hours of a breach likely to risk individuals’ rights .

Build Incident Response Capabilities: Formal incident response plans are essential for detecting, responding to, and recovering from security breaches .

Conduct DPIAs: High-risk processing requires Data Protection Impact Assessments .

Your job is to be prepared. Understand your data protection obligations. Assess your compliance posture. Implement robust frameworks. Seek professional guidance.

With the right approach and the right partner, you can turn data protection compliance from a regulatory burden into a foundation for trust and growth.

Suggested Reading from Our Blog

Protecting Business Information in the Digital Age in Nigeria – This comprehensive guide covers incident response planning, employee training, third-party risk management, registration as a Data Controller or Processor of Major Importance (DCPMI), data protection audits, intellectual property protection, and staying informed about evolving regulations like the NDPA 2023 and GAID 2025. It also outlines Qeeva’s service methodology for information security assessment, data protection framework design, implementation support, and continuous improvement .

Corporate Governance, Risk and Compliance (GRC) – Explore how effective governance, risk management, and compliance frameworks are essential for organizational success. This article covers enterprise risk management, internal control frameworks across IT and cybersecurity domains, and the structured GRC methodology Qeeva uses to help businesses build robust governance structures .

Risk Management Services Nigeria – Understand the various types of risk organizations face, including security and fraud risk, operational risk, and compliance risk. This article details Qeeva’s approach to claims management, loss modeling, risk profiling, and risk tolerance analysis to help businesses protect themselves from threats .

Regulatory Compliance In Nigeria – Comprehensive overview of tax and regulatory compliance requirements for Nigerian businesses, including cybersecurity compliance and data protection obligations.

Internal Control Advisory Service – Learn how to build robust internal controls, including access controls and data security measures that support data protection compliance.

Advisory Services Nigeria – Strategic guidance for navigating regulatory complexity and building compliance frameworks.

Bookkeeping Services – Accurate records are essential for compliance. Our bookkeeping services ensure your records are accurate and complete.

Reference Links / Sources

Aluko & Oyebode – Issuance of the Nigeria Data Protection Act – General Application and Implementation Directive 2025 – GAID overview, repeal of NDPR, compliance measures, and SNAG introduction

Mondaq – Nigeria Data Privacy Law 2025: NDPA & GAID Guide – NDPA and GAID overview, DPO requirements, registration, breach notification, and penalties

KPMG – Review of the NDPA General Application and Implementation Directive (GAID) 2025 – DPO requirements, data processing fees, privacy notices, and data retention rules

Aluko & Oyebode – Key Highlights of the NDPA GAID 2025 – Application of NDPA, effects of NDPR repeal, ROPA, exemptions, and CAR filing

LawPavilion – NDP Act 2023 GAID 2025: A Comprehensive Guide – Objectives and application, extraterritorial reach, and compliance measures

IAPP – From principles to practice: Operationalizing Nigeria’s Data Protection Act – GAID as practical roadmap, scope analysis, and constitutional basis

Balogun Harold – Nigeria Data Privacy Law 2025: NDPA & GAID Guide – Statutory obligations, breach notification, cross-border transfers, and penalties

Multilaw – Data Protection Guide Nigeria – DPIA requirements, breach notification details, and cross-border transfer conditions

UUBO – Regulatory Update: NDPC Issues GAID 2025 – Mandatory compliance measures, DCMI registration, and audit requirements

CookieYes – Nigeria Data Protection Act (NDPA) 2023: Guide for Businesses in 2025 – Data protection principles, lawful basis, DPO appointment, breach notification, and cross-border transfers

SPA Ajibade – NDPC Commences Full Implementation of GAID 2025 – Extent of applicability, DCMI classifications, DPO requirements, and data subject rights

Olaniwun Ajayi – Nigeria Data Protection Act 2023 Newsletter – DCMI definition, registration and fees, and DPO requirements

Aluko & Oyebode – NDPC-GAID Takes Effect on 19 September – GAID effective date and transition from NDPR

TEMPLARS – NDPC Issues the NDPA GAID 2025 – NDPR cancellation, expansion of scope, and compliance audits

Qeeva Advisory – Protecting Business Information in the Digital Age in Nigeria – Incident response planning, employee training, third-party risk management, DCPMI registration, data protection audits, and intellectual property protection

Qeeva Advisory – Corporate Governance, Risk and Compliance (GRC) – Enterprise risk management, internal control frameworks, and GRC methodology

Qeeva Advisory – Risk Management Services Nigeria – Security and fraud risk, operational risk, compliance risk, claims management, and loss modeling

Let’s Talk About Your Data Protection Needs

Navigating Nigeria’s data protection landscape can be complex. At Qeeva Advisory, we understand the challenges faced by organizations in achieving compliance with the NDPA and GAID.

Whether you need help with registration, DPO appointment, breach response, or compliance audits, we are here to support you.

📞 Call us: (+234) 802 320 0801, (+234) 807 576 5799

📧 Email: info@qeeva.com

📍 Visit us: 5, Ishola Bello Close, Off Iyalla Street, Alausa, Ikeja, Lagos, Nigeria

Contact us today to schedule a consultation. Let us help you navigate data protection compliance with confidence.

Your journey to compliance starts with a conversation. Let’s talk.