On March 20, 2025, the Nigeria Data Protection Commission (the
"NDPC") took a significant step toward deepening
regulatory clarity and enforcement with the issuance of the Nigeria
Data Protection Act General Application and Implementation
Directive, 2025 (the "NDP ACT, GAID 2025/ Directive").
1 Released pursuant to its powers under the Nigeria Data
Protection Act, 2023 (the "NDP Act"), the Directive sets
the tone for how data controllers and processors must align their
operations with the NDP Act.2
This article explores key provisions of the GAID 2025 and
unpacks what they mean for organisations navigating Nigeria's
evolving data protection regime.
1. Clarifying the Legal Hierarchy and Transition from
NDPR
