NDPA 2023 / NDPC GUIDELINES January 18, 2026 • ~4 min read

NDPR and NITDA: Historical Background and Transition to NDPA 2023

Reader Mode:

The Evolution of Data Privacy in Nigeria: From Administrative Regulation to Statutory Law

The regulatory environment for data protection in Nigeria has undergone a significant transformation over the last decade. As a Senior Data Protection and Compliance Officer, it is imperative to document the historical progression from the early administrative guidelines issued by the National Information Technology Development Agency (NITDA) to the comprehensive Nigeria Data Protection Act (NDPA) 2023. This transition is not merely a change in nomenclature; it represents a fundamental shift in the legal obligations of data controllers and processors within the Nigerian jurisdiction.

The Genesis: The NITDA Act 2007 and Early Administrative Efforts

Before the emergence of specific data protection regulations, the primary authority for information technology in Nigeria was the National Information Technology Development Agency (NITDA), established by the NITDA Act of 2007. Under Section 6 of the Act, NITDA was mandated to develop regulations and guidelines for electronic governance and the monitoring of information technology practices in the country. For many years, Nigeria lacked a dedicated data privacy framework, relying instead on Section 37 of the 1999 Constitution of the Federal Republic of Nigeria (as amended), which provides a general right to privacy for citizens in their homes, correspondence, and telephone communications.

However, the constitutional provision was insufficient for the complexities of the digital economy. In 2013, NITDA issued the Guidelines on Data Protection, which served as the first formal attempt to regulate how personal information was handled. These guidelines were largely aspirational and lacked the robust enforcement mechanisms required to compel compliance from large organisations. The lack of a clear enforcement structure meant that many entities continued to process personal data without adequate safeguards, leading to significant risks of data breaches and unauthorised access.

The 2019 Milestone: The Nigeria Data Protection Regulation (NDPR)

The most significant turning point occurred on 25 January 2019, when NITDA issued the Nigeria Data Protection Regulation (NDPR). This regulation was heavily influenced by the European Union's General Data Protection Regulation (GDPR) and aimed to bring Nigeria into alignment with international best practices. The NDPR was designed to protect the rights of natural persons to data privacy, foster safe conduct for transactions involving personal data, and enhance the competitiveness of Nigerian businesses in the global market.

The NDPR introduced several critical concepts that remain central to the current framework. It defined 'Personal Data' and 'Sensitive Personal Data'—the latter including health records, financial information, and biometric data. In my professional capacity, I must flag any processing of medical or financial data as High Sensitivity, requiring the highest level of technical and organisational measures. The NDPR also established the rights of data subjects, including the right to be informed, the right of access, the right to rectification, and the right to erasure (the right to be forgotten).

The Data Protection Compliance Organisation (DPCO) Model

One of the unique features introduced by the NDPR was the Data Protection Compliance Organisation (DPCO) model. Recognising that NITDA might lack the internal capacity to audit every data controller in Nigeria, the regulation created a system where private professional firms—such as compliance and audit firms—could be licensed as DPCOs. These organisations are authorised to provide data protection audits, training, and consulting services to data controllers.

This model created a decentralised enforcement mechanism. Data controllers were required to appoint a Data Protection Officer (DPO) and conduct an annual data protection audit. The findings of these audits must be submitted to the regulator by the March 15 deadline each year. This requirement ensures a continuous audit trail and forces organisations to maintain a high standard of data hygiene. The DPCO model remains a cornerstone of the Nigerian compliance system, bridging the gap between the regulator and the regulated entities.

The Intermediate Phase: The Nigeria Data Protection Bureau (NDPB)

As the importance of data privacy grew, it became clear that a department within NITDA was no longer sufficient to manage the expanding regulatory requirements. In February 2022, the Federal Government of Nigeria announced the creation of the Nigeria Data Protection Bureau (NDPB). This was an administrative move to separate the data protection function from NITDA's broader IT mandate. The NDPB was tasked with the primary responsibility of enforcing the NDPR and preparing the groundwork for a substantive Act of the National Assembly.

During this transition period, the NDPB intensified enforcement actions. They focused on sectors with high volumes of Personally Identifiable Information (PII), such as the banking, telecommunications, and aviation sectors. The Bureau also began the process of harmonising various data-related regulations to ensure consistency across different industries. This era was marked by an increased focus on 'Data Controllers of Major Importance'—entities that process a high volume of sensitive data or have a significant impact on the privacy of Nigerian citizens.

The Legislative Zenith: The Nigeria Data Protection Act (NDPA) 2023

The transition reached its culmination on 14 June 2023, when the Nigeria Data Protection Act (NDPA) was signed into law. This Act transformed the NDPB into the Nigeria Data Protection Commission (NDPC), a statutory body with independent legal status. The NDPA 2023 provides a more robust legal foundation than the NDPR, as an Act of the National Assembly carries more weight than an administrative regulation in the Nigerian legal hierarchy.

The Act expands on the principles of data minimisation, purpose limitation, and accountability. It also introduces stricter penalties for non-compliance. Under the NDPA, the Commission can impose fines of up to 10 million Naira or 2% of the previous year's annual gross revenue, whichever is higher, for 'Data Controllers of Major Importance' who violate the law. This significant increase in potential liability has made data protection a boardroom priority for Nigerian corporations. Furthermore, the Act clarifies the legal basis for processing personal data, moving beyond just consent to include legitimate interest, contractual necessity, and public interest.

Key Differences and Compliance Implications

While the NDPR remains valid as a regulation under the new Act (insofar as it does not conflict with the Act), there are key differences that compliance officers must note. The NDPA 2023 provides a clearer definition of 'Data Processors' and 'Data Controllers', ensuring that third-party service providers are held to the same rigorous standards as the primary owners of the data. This is particularly relevant for businesses interacting with the Corporate Affairs Commission (CAMA 2020) and the Federal Inland Revenue Service (FIRS), where financial data is frequently exchanged.

From an audit perspective, the transition requires a review of all existing Data Processing Agreements (DPAs). Organisations must ensure that their contracts with vendors include specific clauses regarding data breach notification timelines and the right to audit. The March 15 audit deadline remains the most critical date in the compliance calendar. Failure to submit the annual audit report to the NDPC can result in immediate regulatory scrutiny and potential fines.

High Sensitivity Data: Financial and Medical Records

In the context of the NDPA 2023, financial and medical data are categorised as 'Sensitive Personal Data'. As a compliance firm, we classify these as High Sensitivity. Any organisation handling such data—including fintechs, hospitals, and insurance companies—must conduct a Data Protection Impact Assessment (DPIA) before commencing any new processing activity. This assessment must identify potential risks to the data subjects and outline the measures taken to mitigate those risks. The NDPC has shown a particular interest in these sectors, and we anticipate increased enforcement activity regarding the unauthorised sharing of financial records and the security of electronic health records.

The Intersection with AML and Corporate Governance

Data protection does not exist in a vacuum. It intersects with Anti-Money Laundering (AML) requirements and general corporate governance. For instance, Designated Non-Financial Businesses and Professions (DNFBPs) must register with the Special Control Unit against Money Laundering (SCUML). While SCUML requires the collection of significant PII for 'Know Your Customer' (KYC) purposes, the NDPA requires that this collection must be proportionate. Organisations must balance the need for regulatory reporting to the FIRS or SCUML with the data minimisation principles of the NDPA. Over-collection of data under the guise of AML compliance is a common risk that we identify during our annual audits.

Conclusion: Preparing for the Future of Data Privacy

The transition from the NITDA-led NDPR to the NDPC-led NDPA represents the maturation of the Nigerian digital economy. The legal framework is now more precise, the regulator is more independent, and the penalties for non-compliance are significantly more severe. For organisations operating in Nigeria, compliance is no longer an optional exercise in corporate social responsibility; it is a statutory requirement that impacts the bottom line and corporate reputation.

As we approach the next audit cycle, businesses must ensure that their internal policies are aligned with the NDPA 2023. This includes updating privacy notices, conducting staff training, and ensuring that all data processing activities are documented for the audit trail. The journey from 2007 to 2023 shows a clear trajectory: the Nigerian government is committed to establishing the country as a safe and reliable destination for digital investment, and rigorous data protection is the foundation of that commitment.

AUTONOMOUS LIVING SAAS

Automate These Requirements with TrustGuard NG

Stop managing privacy policies and statutory breach logs manually. TrustGuard NG automates 72-hour breach reporting, Schedule 4 DPIA wizards, and 30-day DSAR responses across 29 Nigerian native languages.

Explore TrustGuard SaaS →

Slide 1 of 1

The Evolution of Data Privacy in Nigeria: From Administrative Regulation to Statutory Law

The regulatory environment for data protection in Nigeria has undergone a significant transformation over the last decade. As a Senior Data Protection and Compliance Officer, it is imperative to document the historical progression from the early administrative guidelines issued by the National Information Technology Development Agency (NITDA) to the comprehensive Nigeria Data Protection Act (NDPA) 2023. This transition is not merely a change in nomenclature; it represents a fundamental shift in the legal obligations of data controllers and processors within the Nigerian jurisdiction.

The Genesis: The NITDA Act 2007 and Early Administrative Efforts

Before the emergence of specific data protection regulations, the primary authority for information technology in Nigeria was the National Information Technology Development Agency (NITDA), established by the NITDA Act of 2007. Under Section 6 of the Act, NITDA was mandated to develop regulations and guidelines for electronic governance and the monitoring of information technology practices in the country. For many years, Nigeria lacked a dedicated data privacy framework, relying instead on Section 37 of the 1999 Constitution of the Federal Republic of Nigeria (as amended), which provides a general right to privacy for citizens in their homes, correspondence, and telephone communications.

However, the constitutional provision was insufficient for the complexities of the digital economy. In 2013, NITDA issued the Guidelines on Data Protection, which served as the first formal attempt to regulate how personal information was handled. These guidelines were largely aspirational and lacked the robust enforcement mechanisms required to compel compliance from large organisations. The lack of a clear enforcement structure meant that many entities continued to process personal data without adequate safeguards, leading to significant risks of data breaches and unauthorised access.

The 2019 Milestone: The Nigeria Data Protection Regulation (NDPR)

The most significant turning point occurred on 25 January 2019, when NITDA issued the Nigeria Data Protection Regulation (NDPR). This regulation was heavily influenced by the European Union's General Data Protection Regulation (GDPR) and aimed to bring Nigeria into alignment with international best practices. The NDPR was designed to protect the rights of natural persons to data privacy, foster safe conduct for transactions involving personal data, and enhance the competitiveness of Nigerian businesses in the global market.

The NDPR introduced several critical concepts that remain central to the current framework. It defined 'Personal Data' and 'Sensitive Personal Data'—the latter including health records, financial information, and biometric data. In my professional capacity, I must flag any processing of medical or financial data as High Sensitivity, requiring the highest level of technical and organisational measures. The NDPR also established the rights of data subjects, including the right to be informed, the right of access, the right to rectification, and the right to erasure (the right to be forgotten).

The Data Protection Compliance Organisation (DPCO) Model

One of the unique features introduced by the NDPR was the Data Protection Compliance Organisation (DPCO) model. Recognising that NITDA might lack the internal capacity to audit every data controller in Nigeria, the regulation created a system where private professional firms—such as compliance and audit firms—could be licensed as DPCOs. These organisations are authorised to provide data protection audits, training, and consulting services to data controllers.

This model created a decentralised enforcement mechanism. Data controllers were required to appoint a Data Protection Officer (DPO) and conduct an annual data protection audit. The findings of these audits must be submitted to the regulator by the March 15 deadline each year. This requirement ensures a continuous audit trail and forces organisations to maintain a high standard of data hygiene. The DPCO model remains a cornerstone of the Nigerian compliance system, bridging the gap between the regulator and the regulated entities.

The Intermediate Phase: The Nigeria Data Protection Bureau (NDPB)

As the importance of data privacy grew, it became clear that a department within NITDA was no longer sufficient to manage the expanding regulatory requirements. In February 2022, the Federal Government of Nigeria announced the creation of the Nigeria Data Protection Bureau (NDPB). This was an administrative move to separate the data protection function from NITDA's broader IT mandate. The NDPB was tasked with the primary responsibility of enforcing the NDPR and preparing the groundwork for a substantive Act of the National Assembly.

During this transition period, the NDPB intensified enforcement actions. They focused on sectors with high volumes of Personally Identifiable Information (PII), such as the banking, telecommunications, and aviation sectors. The Bureau also began the process of harmonising various data-related regulations to ensure consistency across different industries. This era was marked by an increased focus on 'Data Controllers of Major Importance'—entities that process a high volume of sensitive data or have a significant impact on the privacy of Nigerian citizens.

The Legislative Zenith: The Nigeria Data Protection Act (NDPA) 2023

The transition reached its culmination on 14 June 2023, when the Nigeria Data Protection Act (NDPA) was signed into law. This Act transformed the NDPB into the Nigeria Data Protection Commission (NDPC), a statutory body with independent legal status. The NDPA 2023 provides a more robust legal foundation than the NDPR, as an Act of the National Assembly carries more weight than an administrative regulation in the Nigerian legal hierarchy.

The Act expands on the principles of data minimisation, purpose limitation, and accountability. It also introduces stricter penalties for non-compliance. Under the NDPA, the Commission can impose fines of up to 10 million Naira or 2% of the previous year's annual gross revenue, whichever is higher, for 'Data Controllers of Major Importance' who violate the law. This significant increase in potential liability has made data protection a boardroom priority for Nigerian corporations. Furthermore, the Act clarifies the legal basis for processing personal data, moving beyond just consent to include legitimate interest, contractual necessity, and public interest.

Key Differences and Compliance Implications

While the NDPR remains valid as a regulation under the new Act (insofar as it does not conflict with the Act), there are key differences that compliance officers must note. The NDPA 2023 provides a clearer definition of 'Data Processors' and 'Data Controllers', ensuring that third-party service providers are held to the same rigorous standards as the primary owners of the data. This is particularly relevant for businesses interacting with the Corporate Affairs Commission (CAMA 2020) and the Federal Inland Revenue Service (FIRS), where financial data is frequently exchanged.

From an audit perspective, the transition requires a review of all existing Data Processing Agreements (DPAs). Organisations must ensure that their contracts with vendors include specific clauses regarding data breach notification timelines and the right to audit. The March 15 audit deadline remains the most critical date in the compliance calendar. Failure to submit the annual audit report to the NDPC can result in immediate regulatory scrutiny and potential fines.

High Sensitivity Data: Financial and Medical Records

In the context of the NDPA 2023, financial and medical data are categorised as 'Sensitive Personal Data'. As a compliance firm, we classify these as High Sensitivity. Any organisation handling such data—including fintechs, hospitals, and insurance companies—must conduct a Data Protection Impact Assessment (DPIA) before commencing any new processing activity. This assessment must identify potential risks to the data subjects and outline the measures taken to mitigate those risks. The NDPC has shown a particular interest in these sectors, and we anticipate increased enforcement activity regarding the unauthorised sharing of financial records and the security of electronic health records.

The Intersection with AML and Corporate Governance

Data protection does not exist in a vacuum. It intersects with Anti-Money Laundering (AML) requirements and general corporate governance. For instance, Designated Non-Financial Businesses and Professions (DNFBPs) must register with the Special Control Unit against Money Laundering (SCUML). While SCUML requires the collection of significant PII for 'Know Your Customer' (KYC) purposes, the NDPA requires that this collection must be proportionate. Organisations must balance the need for regulatory reporting to the FIRS or SCUML with the data minimisation principles of the NDPA. Over-collection of data under the guise of AML compliance is a common risk that we identify during our annual audits.

Conclusion: Preparing for the Future of Data Privacy

The transition from the NITDA-led NDPR to the NDPC-led NDPA represents the maturation of the Nigerian digital economy. The legal framework is now more precise, the regulator is more independent, and the penalties for non-compliance are significantly more severe. For organisations operating in Nigeria, compliance is no longer an optional exercise in corporate social responsibility; it is a statutory requirement that impacts the bottom line and corporate reputation.

As we approach the next audit cycle, businesses must ensure that their internal policies are aligned with the NDPA 2023. This includes updating privacy notices, conducting staff training, and ensuring that all data processing activities are documented for the audit trail. The journey from 2007 to 2023 shows a clear trajectory: the Nigerian government is committed to establishing the country as a safe and reliable destination for digital investment, and rigorous data protection is the foundation of that commitment.