What changed with the NDPA 2023
Prior to 2023, data protection in Nigeria was largely governed by the NDPR (a subsidiary regulation). The NDPA 2023 elevates data protection to primary legislation and officially establishes the Nigeria Data Protection Commission (NDPC) as the supreme regulatory authority. It applies comprehensively to data controllers and processors operating in Nigeria, processing data physically in Nigeria, or processing the personal data of any individual located in Nigeria, regardless of where the company is headquartered.
The NDPC's severe enforcement powers
The NDPC is not a passive advisory body. The Commission holds extensive statutory powers to investigate breaches, mandate forensic audits, issue immediate cease and desist orders, impose massive financial sanctions, and completely halt your data processing operations during an investigation. They collaborate directly with the Inspector General of Police's office for criminal enforcement. Ignoring the NDPC is a direct route to operational shutdown.
Core statutory obligations under the NDPA
The Six data processing principles (Section 24)
Your entire engineering and business architecture must mathematically align with these six principles. The NDPC uses these as the absolute baseline during any audit:
- Lawfulness, fairness, and transparency: You cannot hide tracking scripts or bury data sharing agreements in unreadable terms of service.
- Purpose limitation: If you collect a BVN for identity verification, you cannot legally use that BVN to train a marketing algorithm.
- Data minimisation: Do not collect a user's home address if your application only requires an email address to function.
- Accuracy: You must provide technical mechanisms for users to update incorrect records immediately.
- Storage limitation: You must implement automated cron jobs to purge data once the statutory retention period expires.
- Integrity and confidentiality: You must utilize AES-256 encryption at rest, TLS 1.3 in transit, and strictly enforce RBAC (Role-Based Access Control) internally.
Establishing a lawful basis for processing
You cannot process data simply because you want to. You must establish one of six lawful bases: consent, contract, legal obligation, legitimate interests, vital interests, or public task. Most Nigerian businesses blindly default to "consent" without understanding that valid consent under the NDPA must be freely given, highly specific, clearly informed, and instantly revocable. Pre-ticked boxes, forced opt-ins, and bundled consent clauses are entirely illegal.
The 72-hour mandatory breach notification
Section 40 is unforgiving. It requires an official NDPC notification within exactly 72 hours of you becoming aware of a breach that risks people's rights and freedoms. If the breach poses a high risk (e.g., leaked passwords, BVNs, or financial records), you must also issue immediate notices to the affected users. You cannot build this workflow during an active crisis. You must engineer the decision matrix and automated notification templates before the incident occurs.
Fulfilling Data Subject Rights technically
The NDPA explicitly grants users the right to be informed, to access their data, rectification, erasure (the right to be forgotten), restriction of processing, objection, data portability, and human intervention in automated decision-making. Data subjects can and will file complaints directly with the NDPC if you ignore their requests.
The technical infrastructure is where 90% of Nigerian organisations fail. Policy documents do not execute database queries. Data deletion workflows, database row redaction, cryptographic access management, and immutable audit logging are highly complex engineering tasks. If your internal admin dashboard cannot locate, export, and permanently delete a specific customer's data within 72 hours across all microservices, your compliance programme is a facade that will fail an NDPC audit.
Data Protection Officer (DPO) strict requirements
Section 32 mandates that "controllers of major importance" absolutely must appoint a Data Protection Officer (DPO) who possesses expert knowledge of data protection law and technical practice. The DPO may be a direct employee or an external consultant operating under a service contract. Critically, you must grant the DPO direct access to executive management, complete processing records, engineering product roadmaps, and final incident response decisions. They must operate independently without fear of corporate retaliation.
What non-compliance actually costs
Section 48 explicitly defines the financial destruction for non-compliance. The maximum penalty for a controller or processor of major importance is the greater of ₦10 million or 2% of the company's annual gross revenue from the preceding year. For standard controllers, the maximum is the greater of ₦2 million or 2% of gross revenue. Furthermore, the NDPC can legally order a business to halt processing, financially compensate the affected victims, account for all profits generated from the illegal violation, and pay additional remedial fees.
The NDPA Compliance Engineering Checklist
- Official Registration: Register your organization with the NDPC immediately based on your classification level.
- Data Flow Auditing: Map exactly what you collect, where it sits in AWS/Azure, why you need it, how long it stays, and which IAM roles can access it.
- Privacy Policy Overhaul: Update your public privacy policy to strictly meet the NDPA transparency and readability requirements.
- Lawful Basis Documentation: Establish and formally document a lawful basis for every single database table and API endpoint.
- DPO Appointment: Appoint an officially certified DPO and provide them with actual operational authority.
- Breach Response Automation: Build and tabletop test a breach response plan that guarantees 72-hour notification capabilities.
- Technical Hardening: Implement AES-256 database encryption, strict IAM access controls, data pseudonymisation, and centralized audit logging (e.g., Datadog, Splunk).
- DPIA Execution: Conduct Data Protection Impact Assessments (DPIAs) for any high-risk processing (like biometrics or AI) before writing the first line of code.
For the heavily regulated fintech sector, we have translated these rules into a strict technical guide. See our detailed NDPR data privacy checklist for fintechs.
Compliance is an operating condition, not a PDF project
Organisations treating Nigeria data protection as a one-time paperwork project will face catastrophic fines. The companies that survive audits are those that build compliance directly into their DevOps pipelines and engineering operations, with working technical safeguards, automated deletion scripts, and documented incident processes. They do not scramble when a breach notification clock starts ticking; they execute a pre-tested plan.
Need help building NDPA-compliant technical infrastructure and architecture?
Talk to a Security EngineerFrequently asked questions
Who does the NDPA 2023 apply to?
The Act applies to data controllers and processors operating within Nigeria, those processing data physically within Nigeria, or any entity (even foreign) processing the personal data of individuals residing in Nigeria.
What is the penalty for non-compliance under the NDPA?
For controllers of major importance, the maximum fine is the greater of ₦10 million or 2% of the organization's annual gross revenue from the preceding year. Standard controllers face the greater of ₦2 million or 2%.
When must I report a data breach to the NDPC?
Section 40 strictly mandates that you notify the NDPC within 72 hours of becoming aware of a breach that is likely to result in a risk to the rights and freedoms of individuals.
Related reading
Blog: NDPR privacy checklist for fintechs · Protect your business from hackers · Top Nigerian vulnerabilities
Guides: CBN compliance · After a breach
Services: Secure architecture review · Vulnerability assessment