Regulatory Watch · Data Protection

Nigeria's data protection framework moved onto a statutory footing

EducationalRegulatory updateLast reviewed 2026-08-14No named reviewer yet

Published 2026-07-22

What changed, and what it means

Reporting and explanation are kept apart deliberately. The left pane is an account of what happened; the right is our reading of what it means.

What changed — reporting

The Nigeria Data Protection Act 2023 established a statutory framework for the processing of personal data in Nigeria, and created the Nigeria Data Protection Commission as the regulator responsible for it.

The Act sets out principles for processing, lawful bases, obligations on organisations that determine why and how data is processed, and rights for the individuals the data is about.

What it means — our explanation

The practical shift is from guidance-led compliance to a statutory regime with a named regulator. Duties that many organisations treated as good practice now sit on a legislative footing.

For most businesses the work is not sophisticated. It is knowing what personal data you hold and why, holding less of it, securing it, being able to answer the person it belongs to, and having written arrangements with the third parties that process it for you.

The organisations most exposed are not necessarily the largest. They are the ones that cannot say where their data is, because they cannot demonstrate anything at all.

Who is affected

Any organisation that decides why and how personal data is processed, including small businesses.
Organisations that use third-party tools which store or analyse customer or staff data.
Businesses that transfer personal data outside Nigeria as part of ordinary operations.
Employers, because employee and applicant records are personal data too.

When it takes effect

The Act is in force. Confirm the current position on registration, filing and any implementation guidance directly with the Nigeria Data Protection Commission.

Has implementation guidance changed?

Regulators issue implementation guidance and directives over time. Check the Commission's own publications for the current position rather than relying on secondary summaries, including this one.

What businesses should consider

Considerations, not requirements. What actually applies depends on your circumstances.

Build a data inventory before writing any policy - you cannot describe what you have not mapped.
Choose a lawful basis per purpose, and prefer a durable basis over consent where it genuinely fits.
Put written terms in place with every processor that touches your data.
Know where your data physically sits, and under what arrangement it leaves the country.
Have a written breach procedure before an incident, not during one.

What individuals should know

You can ask an organisation what personal data it holds about you.
You can ask for inaccurate data to be corrected.
Consent you gave can generally be withdrawn, though other lawful bases may still apply.
A complaint route exists through the Commission where an organisation will not engage.

What changed, and what it means

Reporting and explanation are kept apart deliberately. The left pane is an account of what happened; the right is our reading of what it means.

What changed — reporting

The Act sets out principles for processing, lawful bases, obligations on organisations that determine why and how data is processed, and rights for the individuals the data is about.

What it means — our explanation

The practical shift is from guidance-led compliance to a statutory regime with a named regulator. Duties that many organisations treated as good practice now sit on a legislative footing.

The organisations most exposed are not necessarily the largest. They are the ones that cannot say where their data is, because they cannot demonstrate anything at all.

Who is affected

Any organisation that decides why and how personal data is processed, including small businesses.
Organisations that use third-party tools which store or analyse customer or staff data.
Businesses that transfer personal data outside Nigeria as part of ordinary operations.
Employers, because employee and applicant records are personal data too.

When it takes effect

The Act is in force. Confirm the current position on registration, filing and any implementation guidance directly with the Nigeria Data Protection Commission.

Has implementation guidance changed?

Regulators issue implementation guidance and directives over time. Check the Commission's own publications for the current position rather than relying on secondary summaries, including this one.

What businesses should consider

Considerations, not requirements. What actually applies depends on your circumstances.

Build a data inventory before writing any policy - you cannot describe what you have not mapped.
Choose a lawful basis per purpose, and prefer a durable basis over consent where it genuinely fits.
Put written terms in place with every processor that touches your data.
Know where your data physically sits, and under what arrangement it leaves the country.
Have a written breach procedure before an incident, not during one.

What changed, and what it means

Who is affected

When it takes effect

What businesses should consider

What individuals should know

Related across the platform

What changed, and what it means

Who is affected

When it takes effect

What businesses should consider

What individuals should know

Related across the platform