On 20 March 2025, the Nigeria Data Protection Commission
published the General Application and Implementation Directive
(GAID) 2025 of the Nigeria Data Protection Act (NDPA) 2023. The
GAID serves as an instrument to aid the implementation of the Act
by providing practical guidance and detailed directives for data
controllers and data processors to ensure compliance with the
Act.
The GAID comprises fifty-two (52) Articles and ten (10)
Schedules, which expand on the data protection framework
established by the Act. The GAID defines additional specific
requirements, offering more granular interpretations and practical
considerations of the Act's implementation.
Our review highlights the key focus areas of the GAID,
summarizing new provisions introduced into the data privacy
framework while also examining the implications for organisations.
Additionally, we have provided our perspectives on certain aspects
of the GAID, particularly where data controllers and
