Nigeria Data Privacy Law 2025: NDPA & GAID Guide

Nigeria's data privacy landscape is anchored by the Nigeria Data Protection Act, 2023 (the "NDPA"), administered by the Nigeria Data Protection Commission (the "NDPC"). In March 2025, NDPC issued the General Application and Implementation Directive (GAID) 2025, an operational rulebook that consolidates how the Act applies in practice and introduces detailed rules (including cross-border transfers and registration of "data controllers/processors of major importance," or DCMIs/DPMIs). The NDPC has communicated GAID's effective date as 19 September 2025, until then the NDPA governs, and NDPC has said it will cease applying the older NDPR as a regulatory instrument once GAID takes effect. The foregoing are some of the questions we have had to field from global clients seeking clarity on how Nigeria's data privacy framework aligns with and diverges from familiar regimes like the GDPR and UK GDPR.