Nigeria’s data-protection law covers manual and digital handling of personal information, while registration and annual filing duties depend on the Nigeria Data Protection Commission’s classification of an organization.
The Nigeria Data Protection Act, 2023, applies when a data controller or processor operates in Nigeria, processes information there, or handles personal data about someone in Nigeria from abroad. The Act defines processing broadly, including collecting, storing, using and disclosing information that can identify a person.
It requires organizations to process data fairly, lawfully and transparently, use it for specified purposes, limit collection and retention, maintain accuracy and provide appropriate security. Before collecting information directly, a controller must explain the purpose and lawful basis, recipients, retention period and relevant rights.
Consent is one lawful basis. Others include a legal obligation, legitimate interests, or processing necessary to perform a contract or take steps requested before one is made. The Act says silence or inactivity does not count as consent.
The Commission’s General Application and Implementation Directive divides designated data controllers and processors of major importance into Ultra-High, Extra-High and Ordinary-High tiers. Those designated organizations must register and appoint a Data Protection Officer. Ultra-High and Extra-High entities file annual Compliance Audit Returns; Ordinary-High entities renew registration annually instead of filing those returns.
For organizations required to file annual returns, the directive sets March 31 for entities established before June 12, 2023. Later-established entities have an initial 15-month filing period before moving to annual returns. The Commission extended the 2025 return deadline by 60 days, to May 30, 2026. The recurring schedule points to March 31, 2027, for the next return from organizations on that calendar, though that date is inferred from the directive rather than a separate 2027 notice.
The directive also calls for data-processing agreements with outside processors, periodic audits and staff training at least once a year. The Act sets the maximum penalty for a major-importance controller or processor at the greater of ₦10 million or 2% of gross revenue in the preceding financial year. For other controllers and processors, the maximum is the greater of ₦2 million or 2%.
The Commission’s 2025 annual report lists 230 investigations, 38,841 registered organizations of major importance and ₦7.2 billion in compliance revenue. It says the NDPC was moving toward full enforcement of the Act and directive. The Commission also announced a ₦766,242,500 fine against Multichoice Nigeria over alleged privacy-rights violations and unlawful cross-border data transfers; it said its investigation began in the second quarter of 2024.
