Exemption From NDPC Registration Does Not Mean Exemption From Data Protection Compliance: Understanding The GAID Framework

1. Introduction

The introduction of registration requirements for certain data controllers and data processors under the General Application and Implementation Directive (GAID)¹ has significantly altered the compliance landscape of Nigeria's data protection regime. However, the registration framework has also given rise to a common misconception among organisations that fall below the prescribed registration thresholds or otherwise qualify for an exemption: namely, that exemption from registration translates into exemption from data protection obligations.

This assumption is not supported by the broader framework of the Nigeria Data Protection Act² and its Implementation Framework. While the GAID may exempt certain organisations from the obligation to register with the Nigeria Data Protection Commission (NDPC), such exemption do not automatically relieve those organisations of their substantive responsibilities as data controllers or data processors. The core principles of lawful