Nigeria Data Protection Regulation (NDPR) — 2019

Why does it matter?

The NDPR was Nigeria's first comprehensive data protection regulation and set the vocabulary that the NDPA and the NDPC now use: data controller, data subject, consent, privacy policy and audit. A Nigerian organization that built its program around the NDPR has a base of policies, audit summaries and DPO records to carry into the NDPA, but must check each duty against the Act, because the Commission no longer applies the NDPR itself.

Key benefits include:

• Published rules for processing

Clause 2.1 requires personal data to be collected for a specific, legitimate and lawful purpose the data subject consented to, kept adequate and accurate, stored only as long as needed and secured against foreseeable hazards.

• A duty of care

Clause 2.1(2) and (3) make anyone holding personal data owe the data subject a duty of care and be accountable for acts and omissions.

• Named penalties

Clause 2.10 set a fine of 2% of annual gross revenue or NGN 10 million, whichever is greater, for a controller dealing with more than 10,000 data subjects, and 1% or NGN 2 million for fewer than 10,000.

• An audit trail

Clause 4.1(5) to (7) required a documented audit of privacy practices and an annual summary to NITDA for controllers processing data of more than 2,000 data subjects, due by March 15.

• Clear transfer rules

Clauses 2.11 and 2.12 allowed transfers to a foreign country on an adequacy decision or on listed conditions such as explicit consent after being told of the risks.

How does it work?

Part Two sets the substance. Processing is lawful on one of five grounds (clause 2.2): consent, contract, legal obligation, vital interests or a task in the public interest or official mandate. Consent must be demonstrable and withdrawable (clause 2.3). Every collection medium must display a privacy policy that states, among other things, what constitutes consent, the purpose of collection and the remedies for violation (clause 2.5). Security measures must include controls such as firewalls and encryption (clause 2.6), and third-party processing needs a written contract (clause 2.7).

Part Three gives data subjects rights to clear information before collection, a reply to a request within one month (clause 3.1(2)), correction, erasure on listed grounds (clause 3.1(9)), restriction of processing (clause 3.1(11)) and data portability (clause 3.1(14)). Clause 2.8 adds a right to object to marketing processing, free of charge.

Part Four makes it operational. Every controller designates a Data Protection Officer, who may be outsourced (clause 4.1(2)). NITDA licenses DPCOs to audit, train and advise controllers (clause 4.1(4)). Controllers publish a data protection policy, carry out a privacy audit and file audit summaries with NITDA (clause 4.1(1), (5) to (7)). NITDA's Administrative Redress Panel investigates alleged breaches and aims to conclude within 28 working days (clause 4.2).

Key Elements

• Principles and lawful processing (clauses 2.1 and 2.2)

Purpose limitation, accuracy, storage limitation, security, duty of care and accountability, and the five lawful grounds.

• Consent and privacy policy (clauses 2.3 and 2.5)

Controllers must be able to demonstrate consent, and every collection medium displays a plain-language privacy policy.

• Data subject rights (clause 3.1)

Information, access, correction, erasure, restriction, portability and objection, with a one-month response.

• Cross-border transfer (clauses 2.11 and 2.12)

Transfers rest on an adequacy decision, supervised by the Attorney General of the Federation, or on listed conditions such as explicit consent.

• DPO and DPCOs (clause 4.1)

A designated Data Protection Officer and NITDA-licensed Data Protection Compliance Organizations.

• Audit and penalties (clauses 4.1(5) to (7) and 2.10)

A privacy audit, an annual summary due March 15, and fines of 2% or 1% of annual gross revenue, or the fixed naira floor.

What does it cover?

The NDPR applies to all transactions intended for the processing of personal data of natural persons residing in Nigeria and of Nigerian citizens residing outside Nigeria, regardless of the means of processing (clause 1.2). Clause 1.3 defines the data controller, the data administrator, the Data Protection Compliance Organization and sensitive personal data, which covers religious or other beliefs, sexual orientation, health, race, ethnicity, political views, trade union membership and criminal records. NITDA's Implementation Framework states that the NDPR does not apply to uses of data for national security and similar statutory exceptions.

What are its objectives?

Clause 1.1 states the objectives of the NDPR; the Implementation Framework adds guidance on how to meet them.

Safeguard the rights of natural persons to data privacy.

Foster safe conduct for transactions involving the exchange of personal data.

Prevent manipulation of personal data.

Keep Nigerian businesses competitive in international trade through a data protection framework in tune with best practice.

Give data subjects redress through the Administrative Redress Panel and the courts (clause 4.2).

Framework in Context

The NDPR was issued under section 6(a) and (c) of the NITDA Act 2007; NITDA's Implementation Framework of November 17, 2020 says it explains the NDPR and does not supersede it. The NDPA 2023 now sets the primary rules: section 63 gives the Act priority over inconsistent laws, section 64(2)(f) keeps earlier NITDA instruments in effect until they expire or are repealed, replaced or altered, and the NDPC's GAID 2025 says in Article 3(3) that the Commission ceased to apply the NDPR as a legal instrument. Commentators disagree on whether the NDPR has been formally repealed, so organizations check the current NDPA and GAID provisions.

Common Framework Mappings

Organizations map the NDPR with international privacy standards so that one set of controls and records serves Nigerian and cross-border requirements.

Mapped frameworks include:

APEC PF

Convention 108+

GDPR

ISO 27001:2022

ISO 27002:2022

ISO 27701

NIST Privacy Framework v1.0

OECD Privacy Guidelines