GAID 2025 Unpacked: Critical Updates On Data Processing, Individual Obligations, And Compliance Measures

Introduction

On March 20, 2025, the Nigeria Data Protection Commission ("NDPC") released the General Application and Implementation Directive 2025 ("GAID"), superseding the Nigeria Data Protection Regulation (NDPR) 2019. The GAID operationalizes the Nigeria Data Protection Act, (NDPA) 2023, introducing a more structured and comprehensive framework for data processing activities in Nigeria. our initial publication provided an overview of its key features and the broader implications for data governance under the NDPA.

In this follow-up, we shift our focus from general highlights to a more detailed analysis of three critical provisions introduced under the GAID that carry significant implications for data controllers, processors, and even individuals: (a) increased obligations for individuals processing personal data for household or personal purposes, (b) detailed compliance measures for data controllers and processors, and (c) reinforcing categorization of data