Highlights of The Nigeria Data Protection Act General Application and Implementation Directive

On March 20, 2025, the Nigeria Data Protection Commission (the “NDPC”) issued the Nigeria Data Protection Act General Application and Implementation Directive, 2025 (“GAID”), pursuant to its powers under section 61 of the Nigeria Data Protection Act, 2023 (“NDPA”). The GAID is aimed at providing clarity and practical guidance on the implementation of the NDPA. However, where any inconsistency arises between the NDPA and the GAID, the provisions of the NDPA will prevail.[1]

Regulatory oversight of the NDPC has intensified, with the NDPC actively sanctioning companies that consistently violate the NDPA.[2] Enforcement efforts are also gaining momentum, with private citizens instituting suits to enforce their rights under the NDPA.[3]  

The GAID has arrived at a timely moment to enhance general understanding and support the practical implementation of the NDPA. The GAID seeks to protect the personal data and  fundamental right to privacy of the following data subjects[4]: (a) individuals within the territory of Nigeria; (b) individuals whose personal data has been transferred to Nigeria; (c) individuals whose personal data is in transit through Nigeria, provided that the data controller or data processor responsible for the transmission is subject to a jurisdiction with adequate data privacy laws; and (d) Nigerian citizens residing outside Nigeria.[5]

[1]GAID, art. 3(2).

[2]Fidelity Bank “Fidelity Bank Affirms Commitment to Data Protection and Strong Corporate Governance”, available at <https://www.fidelitybank.ng/fidelity-bank-affirms-commitment-to-data-protection-and-strong-corporate-governance/> Where Fidelity Bank confirmed the NDPC’s fine of ₦555.8 Million, for data privacy breaches.  

[3]Notably the cases of (FHC/ABJ/CS/1432/2019) - Olumide Babalola LP et al. v. True Software Scandinavia et al. and (FHC/ABJ/CS/195/2024) - Chukwunweike Araka v. Ecart Internet Serviced Nigeria Ltd. et al.

[4]A data subject means an individual whom personal data relates to (NDPA, s. 65)

[5]GAID, art. 1(4).

--

Read the full publication at G. Elias & Co.