What the NDPA asks of your team, day to day

In many organisations, the Nigeria Data Protection Act 2023 (NDPA) lives in a folder owned by the legal team. Meanwhile, personal data lives everywhere else: the admissions form, the HR spreadsheet, the customer database, the vendor tool someone signed up for last year, and the laptops staff take home.

That gap matters because the regulator's questions are mostly operational. When the Nigeria Data Protection Commission (NDPC) sent a 21-day compliance notice to tertiary institutions in February 2026, it asked for evidence of audit filings, a data protection officer, registration and a summary of the technical and organisational measures protecting personal data. Those are things your operations and IT teams either can or cannot show.

This guide translates the NDPA and the NDPC's General Application and Implementation Directive (GAID) 2025 into everyday work. It is general information, not legal advice; confirm how it applies to you with your legal adviser or data protection officer (DPO).

Know what you hold, and why

Every use of personal data needs a lawful basis. Section 25 of the Act lists six: consent, contract, legal obligation, vital interests, public interest or official authority, and legitimate interests. If you rely on consent, you carry the burden of proving it, and silence or inactivity does not count (section 26).

In practice, this means a data inventory. For each system, record what personal data it holds, why, which lawful basis applies, who can access it, where it is stored, which vendors touch it and how long you keep it. Most of the obligations below depend on this list.

Check whether you are "of major importance"

Several duties apply only to data controllers and processors of major importance. The NDPC's updated registration guidance notice includes organisations that process the personal data of more than 200 people in six months, and those operating in listed sectors such as education, health, financial services and public service. It sorts them into three tiers: Ultra-High Level (UHL), Extra-High Level (EHL) and Ordinary-High Level (OHL).

If you fall within these categories:

• Register with the NDPC, and notify it of significant changes within 60 days (section 44).
• Designate a DPO with expert knowledge of data protection law and practice (section 32). The DPO may be an employee or engaged under a service contract.
• File Compliance Audit Returns annually by 30 May if you are UHL or EHL, through a licensed Data Protection Compliance Organisation, unless the NDPC approves otherwise (GAID Article 10).

The GAID also expects every controller and processor to conduct a compliance audit within 15 months of starting business, and annually after that (Article 7).

Tier also affects the stakes. Where the NDPC finds a violation, the maximum penalty or remedial fee it can order for an organisation of major importance is the greater of ₦10 million or 2% of the previous year's annual gross revenue (section 48). For other organisations, it is the greater of ₦2 million or 2%.

Make rights requests routine

People can ask whether you process their data, why, who receives it and how long you keep it, and request a copy in a commonly used electronic format (section 34). The Act requires this "without constraint or unreasonable delay". The GAID asks organisations to design systems that make access, correction and data portability straightforward, and to explain how people can complain (Article 7).

The operational test is simple: could your team find everything you hold about one person, across every system, within days rather than weeks?

Assess high-risk processing before you start

Where processing is likely to pose a high risk to people's rights, the Act requires a data privacy impact assessment (DPIA) before processing begins (section 28). The GAID makes a DPIA mandatory, and to be filed with the Commission, in specific situations (Article 28). These include:

• student or pupil records in educational services
• health care and hospitality services
• financial services that process personal data through digital devices
• surveillance cameras in places the public can access
• sensitive personal data or vulnerable people
• cross-border data transfers

For schools, hospitals, banks and public bodies, a new system or vendor will often trigger this step.

Treat security as an engineering task

Section 39 requires "appropriate technical and organisational measures" to protect personal data. Appropriateness depends on the volume and sensitivity of the data, the potential harm and the size of the organisation. The Act's examples include encryption, pseudonymisation, the ability to restore access after an incident, and regular testing of whether the measures work.

In day-to-day terms, this means knowing who can access which records, removing access when people leave, protecting devices that store personal data, and testing backups.

Prepare for a breach before it happens

When a breach is likely to put people's rights at risk, the controller must notify the NDPC within 72 hours of becoming aware of it (section 40). If the risk to individuals is high, the controller must also tell them immediately, in plain language. Processors must inform the controller as soon as they become aware of a breach. Every breach must be recorded, whether or not it is reported. The NDPC runs an online breach reporting portal.

Seventy-two hours is short if nobody knows who decides. Agree in advance who assesses an incident, who reports it and what information they need.

Put vendors and transfers in writing

When a processor handles personal data for you, section 29 requires a written agreement. The GAID lists what it should cover, including purpose, location of processing, lawful basis, security measures and evidence of the vendor's NDPA compliance (Article 34).

Transfers outside Nigeria, including many cloud and software services, need an adequate level of protection or one of the conditions in section 43, and you must record the basis you rely on (section 41).

Give the work an owner

The GAID expects the DPO to report directly to management and to compile a semi-annual data protection report for management (Articles 12 and 13). It also expects staff training within six months of starting business and at least annually after that, a published privacy policy, and a cookie notice on the website's homepage that lets visitors accept or decline (Article 7). In June 2026, the NDPC added a guidance notice on continuing professional development for DPOs.

A 30-day starting plan

You will not finish compliance in a month. You can, however, replace uncertainty with a clear list of gaps and owners.

Week 1: ownership and status

• Name an accountable executive and confirm who acts as DPO.
• Ask your legal adviser or DPO to confirm whether you are of major importance, and in which tier.
• Collect what already exists: privacy policy, registration records, past audit filings and vendor contracts.

Week 2: inventory

• Map your five most important systems: data held, purpose, lawful basis, access, location, vendors and retention.
• Note any processing that falls into the GAID's mandatory DPIA list.

Week 3: vendors and access

• List every vendor that handles personal data and check for a written agreement.
• Mark which vendors store or process data outside Nigeria.
• Review who has access to your most sensitive records and remove what is no longer needed.

Week 4: response and reporting

• Write a one-page breach procedure with names, the 72-hour clock and the reporting route.
• Set up one intake channel for rights requests and a way to search across systems.
• Schedule staff training and present the gap list to management, with owners and dates.

Where VIS can help

Much of this work is technical: building the data inventory, controlling access, securing systems and making records findable. VIS's cybersecurity service covers security audits, penetration testing, secure authentication and compliance implementation support, within an agreed scope and written authorisation. Our data engineering work helps organisations bring scattered data into pipelines and stores with clear ownership.

We do this alongside your legal advisers and DPO. VIS does not provide legal advice or certify compliance; our role is to help put the technical measures in place and make them easier to evidence.

If your team has started the inventory and found more systems than expected, talk to us about the work.

• NDPA 2023
• GAID 2025
• Data protection
• Compliance
• Cybersecurity
• Nigeria