On March 20, 2025, the Nigeria Data Protection Commission
("NDPC" or "the Commission"), pursuant to its
powers in the Nigeria Data Protection Act ("NDPA" or
"the Act"), issued the NDPA General Application and
Implementation Directive ("GAID"), which is to take
effect from September 19, 2025.
We have highlighted below some of the key provisions introduced
by GAID that you need to know.
1. Applicability
With the issuance of the GAID, the Nigeria Data Protection
Regulation (NDPR) 2019 will no longer govern data privacy and
protection[1]. However, actions taken pursuant to the NDPR prior to
the implementation of GAID will remain unaffected. Additionally, as
the NDPR 2019: Implementation Framework 2020 was introduced to
supplement the NDPR, its applicability as a legal instrument will
also cease with the introduction of the GAID.[2] Therefore, the two
main laws that will regulate data protection in Nigeria, with
effect from September 19, 2025, are the NDPA and the
