Nigeria Data Protection Act 2023 (NDPA)
Security and Accountability

Nigeria Data Protection Act 2023 (NDPA) NG-NDPA-5: Security of Processing, Breach Notification, and DPIA

Implement appropriate technical and organisational measures per NDPA Section 40 including encryption + pseudonymisation + integrity protection + confidentiality + restoration capabilities + regular testing. Notify NDPC of personal data breaches within 72 hours per Section 40 + notify data subjects when high risk per Section 40(4). Conduct Data Protection Impact Assessments (DPIA) per Section 39 for high-risk processing including profiling + systematic monitoring + large-scale sensitive data processing. Consult NDPC for high residual risk.

What else in your programme already covers this

This control maps to 383 controls across 141 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

Switzerland New Federal Act on Data Protection (nFADP/nDSG, 2023) · 9 controls

Nebraska Data Privacy Act · 7 controls

  • NDPA-1 Applicability, Scope, and Carve-Outs
  • NDPA-2 Consumer Rights - Access, Correct, Delete, Portability, Appeal
  • NDPA-3 Opt-Out Rights for Targeted Advertising, Sale, and Profiling
  • NDPA-4 Sensitive Data Processing Consent and Childrens Protections
  • NDPA-6 Reasonable Security Practices and Incident Response
  • NDPA-7 Data Protection Assessments and Processor Contracts
  • NDPA-8 Nebraska Attorney General Enforcement, Permanent 30-Day Cure, and Penalties

ISO 22320:2018 · 6 controls

ISO/IEC 27400:2022 · 6 controls

ISO/IEC 29100:2024 · 6 controls

APPI · 5 controls

  • APPI-A23 Security Control Measures
  • APPI-A24 Supervision of Employees
  • APPI-A33 Request for Disclosure of Retained Personal Data
  • APPI-A41 Preparation and Handling of Pseudonymized Personal Information
  • APPI-A43 Preparation of Anonymized Personal Information

Austria Data Protection Act (Datenschutzgesetz, DSG, amended 2018) · 5 controls

  • AT-DSG-11 Sections 42-45 - Data subject rights (law enforcement)
  • AT-DSG-13 Section 36 - Scope of law enforcement processing
  • AT-DSG-14 Section 38 - Lawfulness of law enforcement processing
  • AT-DSG-2 Section 2 - Scope and application
  • AT-DSG-8 Section 22 - Functions and powers of the DPA

Bahrain PDPL · 5 controls

Barbados Data Protection Act 2019 · 5 controls

  • BB-DPA-14 Section 15 - Right to Data Portability
  • BB-DPA-16 Section 22 - General Principle for Transfers
  • BB-DPA-2 Section 2 - Interpretation
  • BB-DPA-20 Sections 50-60 - Registration and Responsibilities
  • BB-DPA-21 Sections 61-69 - Data Privacy Officer

GDPR · 5 controls

  • GDPR-Art.10 Processing of personal data relating to criminal convictions
  • GDPR-Art.11 Processing which does not require identification
  • GDPR-Art.15 Right of access by the data subject
  • GDPR-Art.19 Notification obligation regarding rectification, erasure or restriction
  • GDPR-Art.9 Processing of special categories of personal data

ISO 15189:2022 - Medical Laboratories Requirements for Quality and Competence · 5 controls

ISO/IEC 27557:2022 - Organisational Privacy Risk Management · 5 controls

ISO/IEC 29134:2023 · 5 controls

NIST SP 800-171A Rev 3 - Assessing CUI Security Requirements · 5 controls

  • 3.3 Configure Data Access Control Lists
  • 3.6 Encrypt Data on End-User Devices
  • 3.6.1 Procedures are defined and implemented to protect cryptographic keys used to protect stored account data against disclosure and misuse that include: • Access to keys is restricted to the fewest number of custodians necessary.
  • FEDRAMP-CM-6 Configuration Settings
  • FEDRAMP-CP-9 System Backup

South Korea ISMS-P · 5 controls

Annex 11 to EU GMP - Computerised Systems · 4 controls

Azerbaijan Law on Personal Data (2010) · 4 controls

FFIEC IT Examination Handbook · 4 controls

  • FFIEC-05 Roles and responsibilities definition
  • FFIEC-23 Regulatory reporting requirements
  • FFIEC-24 Customer notification procedures
  • FFIEC-25 Post-incident review and improvement

IAEA Nuclear Security Series - Computer Security at Nuclear Facilities (NSS-17-T Rev 1) · 4 controls

ISO/IEC 23894:2023 · 4 controls

ISO/IEC 27014:2020 · 4 controls

ISO/IEC 30111:2019 · 4 controls

ISO/IEC 38500:2024 - Governance of IT · 4 controls

NIST SP 800-124 Revision 2 - Guidelines for Managing the Security of Mobile Devices · 4 controls

API 1164 · 3 controls

Albania Law on Protection of Personal Data (Law No. 9887, 2008, amended 2014) · 3 controls

Armenia Law on Protection of Personal Data (2015) · 3 controls

Australian Privacy Principles (APPs) · 3 controls

  • APP-1 APP 1 - Open and transparent management of personal information
  • APP-3 APP 3 - Collection of solicited personal information
  • APP-5 APP 5 - Notification of the collection of personal information

BRCGS Global Standard for Food Safety Issue 9 · 3 controls

  • 1.2 Operating System Privileged Account Control
  • 1.3 Virtualisation Platform Protection
  • 3.3 Configure Data Access Control Lists

BSI IT-Grundschutz · 3 controls

  • BSI-18 Incident response planning and testing
  • BSI-20 Incident reporting and notification
  • BSI-21 Forensic analysis capabilities

EASA Part-IS - Information Security in Aviation · 3 controls

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL) · 3 controls

Florida Digital Bill of Rights (FDBR) · 3 controls

IEC 62304:2015 Medical Device Software Lifecycle Processes · 3 controls

IEC 62443 · 3 controls

ISO 19650 - Organisation and Digitisation of Information about Buildings and Civil Engineering Works (BIM) · 3 controls

ISO 22739:2024 - Blockchain and Distributed Ledger Technologies Vocabulary · 3 controls

ISO 27019 · 3 controls

ISO 37000:2021 - Governance of Organizations · 3 controls

ISO/IEC 23837 - Security Requirements for Quantum Key Distribution · 3 controls

ISO/IEC 27004:2016 · 3 controls

ISO/IEC 27011:2024 · 3 controls

ISO/IEC 29147:2018 · 3 controls

Illinois Biometric Information Privacy Act (BIPA) · 3 controls

New Hampshire Data Privacy Act · 3 controls

  • NHPA-5 Privacy Notice, Data Minimisation, and Purpose Limitation
  • NHPA-6 Reasonable Data Security and Breach Response
  • NHPA-7 Data Protection Assessments and Processor Contracts

New Jersey Data Privacy Act · 3 controls

  • NJDPA-2 Consumer Rights - Access, Correct, Delete, Portability, Appeal
  • NJDPA-6 Reasonable Data Security and Incident Response
  • NJDPA-8 AG Platkin Enforcement, 18-Month Cure Sunset, and Division of Consumer Affairs

Pakistan Personal Data Protection Bill 2023 · 3 controls

  • PAKPDPB-5 Security of Processing and Personal Data Breach Notification
  • PAKPDPB-7 NCPDP, Registration, Records, Processor Contracts, DPO
  • PAKPDPB-8 Enforcement, Penalties, Complaints, Retention, Training

South Korea PIPA · 3 controls

21 CFR Part 58 - Good Laboratory Practice (GLP) · 2 controls

APRA CPS 234 · 2 controls

  • CPS234-21 Implementation of Information Security Controls
  • CPS234-25 Internal Audit Review of Information Security Controls

ASD Strategies to Mitigate Cyber Security Incidents · 2 controls

  • ASD37-31 Hunt to discover incidents (Very Good)
  • ASD37-33 Capture network traffic (Limited)

ASIS SPC.1-2009 - Organizational Resilience Standard · 2 controls

  • 4.4.1 Resources, Roles, Responsibility, and Authority
  • 4.4.7 Emergency and Incident Response

Automotive SPICE (ASPICE) v4.0 - Process Assessment Model · 2 controls

  • MLE.1 Machine Learning Requirements Analysis
  • MLE.3 Machine Learning Training

COSO Internal Control - Integrated Framework (2013) · 2 controls

  • CA-10 Selects and Develops Control Activities
  • CA-12 Deploys Through Policies and Procedures

DAMA-DMBOK2 - Data Management Body of Knowledge (2nd Edition) · 2 controls

  • DA-1 Enterprise Data Architecture
  • DIQ-2 Data Quality Management

FTC GLBA Safeguards Rule (16 CFR Part 314) · 2 controls

ICH Q10 - Pharmaceutical Quality System · 2 controls

IEC 60601-1 - Medical Electrical Equipment Safety · 2 controls

ISO 19011 · 2 controls

  • 6.5 Preparing and Distributing Audit Report
  • 6.7 Conducting Audit Follow-up

ISO 20400:2017 - Sustainable Procurement · 2 controls

ISO 27017 · 2 controls

ISO 27018 · 2 controls

ISO 28001:2007 Supply Chain Security Management · 2 controls

ISO 41001:2018 - Facility Management Systems · 2 controls

ISO 56002 · 2 controls

ISO 8000 - Data Quality · 2 controls

ISO/IEC 17025:2017 - General Requirements for Testing and Calibration · 2 controls

ISO/IEC 25012:2008 - Data Quality Model · 2 controls

NATO STANAG 4774 (Confidentiality Metadata Labels) and STANAG 4778 (Metadata Binding) · 2 controls

  • STANAG-1 STANAG 4774 Confidentiality Label Schema and XML Structure
  • STANAG-2 STANAG 4778 Metadata Binding Mechanism and Cryptographic Binding

NIST Special Publication 800-34 Revision 1, Contingency Planning Guide for Federal Information Systems · 2 controls

  • NISTSP34-1 Contingency Planning Policy, Programme, and Plan Coordination
  • NISTSP34-2 Business Impact Analysis (BIA): Critical Resources, Recovery Priorities

Nevada Gaming Control Board Cybersecurity Requirements · 2 controls

  • NGCB-6 Incident Response, 72-Hour NGCB Notification, and Independent Investigation
  • NGCB-7 Patron and Employee Data Protection + Data Inventory + Vendor Management

OWASP DevSecOps Maturity Model (DSOMM) · 2 controls

  • DSOMM-1 Culture, Organization, Education, and Governance
  • DSOMM-2 Implementation Practices, Secure Coding, and Threat Modelling

OWASP Top 10:2025 · 2 controls

PCAOB AS 2201 - Audit of Internal Control Over Financial Reporting (ICFR) · 2 controls

  • ASTWO-7 Deficiency Evaluation, Material Weakness, and Communication
  • ASTWO-8 ICFR Opinion, Basis, Definition, Limitations, Combined vs Separate Reports

Privacy Act 1988 (Australia) · 2 controls

  • AUPRV-4 APP 10-11 Quality, Security of Personal Information
  • AUPRV-7 Notifiable Data Breaches (NDB) Scheme, Incident Response

Russia Federal Law on Personal Data (152-FZ) · 2 controls

  • RUSPD-1 Scope, Definitions, Principles under 152-FZ
  • RUSPD-4 Special Categories, Biometric Data

Science Based Targets Initiative (SBTi) - Net-Zero Standard · 2 controls

  • C1 Organizational Boundary
  • C3 Scope 1 and 2 Coverage

Singapore Government Instruction Manual on ICT&SS Management (IM8) · 2 controls

UK Defence Standard 05-138 - Cyber Security for Defence Suppliers · 2 controls

  • D.1 Incident Response Planning
  • D.2 Incident Reporting

US Maritime Transportation Security Act (MTSA) and USCG Cybersecurity Requirements · 2 controls

  • CYB-5 Cyber Incident Response Plan
  • USMTSA-2 Cybersecurity Assessment and CSO Designation

USMCA Chapter 19 - Digital Trade (United States-Mexico-Canada Agreement) · 2 controls

Vietnam Law on Cybersecurity (No. 24/2018/QH14) · 2 controls

21 CFR Part 211 - Current Good Manufacturing Practice · 1 control

APRA CPS 230 Operational Risk Management · 1 control

  • CPS230-13 Board Accountability for Operational Risk Management

AWWA Cybersecurity Guidance for the Water Sector (American Water Works Association) · 1 control

Azure Security Benchmark · 1 control

  • DS-2 Ensure software supply chain security

CISA Cross-Sector Cybersecurity Performance Goals (CPG) 2.0 · 1 control

  • CPG-6.B Supply Chain Incident Reporting

COBIT 2019 · 1 control

Canada ITSG-33 - IT Security Risk Management · 1 control

Estonia Personal Data Protection Act (Isikuandmete kaitse seadus, 2019) · 1 control

FFIEC Cybersecurity Assessment Tool (CAT) · 1 control

FedRAMP High · 1 control

  • CA-9 Internal System Connections

FedRAMP Moderate · 1 control

  • CA-9 Internal System Connections

French Sapin II Law (Law No. 2016-1691) · 1 control

IAIS Insurance Core Principles (ICPs) · 1 control

  • ICP-1 Objectives, Powers and Responsibilities of the Supervisor

IATA Operational Safety Audit (IOSA) Standards Manual · 1 control

IEC 62351 - Power Systems Communication Security · 1 control

ISO 14064 - Greenhouse Gas Accounting and Verification (Parts 1-3) · 1 control

ISO 20000-1 · 1 control

ISO 26262:2018 - Functional Safety for Road Vehicles · 1 control

ISO 27043 · 1 control

ISO 31000:2018 · 1 control

  • 6.7 Conducting Audit Follow-up

ISO/IEC 27003:2017 · 1 control

ISO/IEC 27007:2020 · 1 control

ISO/IEC 27010:2015 · 1 control

ISO/IEC 27031:2011 · 1 control

ISO/IEC 27050 - Electronic Discovery (Parts 1-4) · 1 control

ISO/IEC 29115:2023 - Entity Authentication Assurance Framework · 1 control

ISO/SAE 21434 · 1 control

ITIL 4 · 1 control

ITU-T X.805 - Security Architecture for End-to-End Communications · 1 control

Kuwait National Cybersecurity Framework · 1 control

MARS-E - Minimum Acceptable Risk Standards for Exchanges · 1 control

NERC CIP · 1 control

  • NERCCIP-6 Incident Reporting and Response Planning + Recovery Plans (CIP-008 + CIP-009)

NIST Post-Quantum Cryptography Standards (FIPS 203, 204, 205) · 1 control

  • PQC-4 FIPS 205 SLH-DSA Implementation - Stateless Hash-Based Digital Signature

NIST Privacy Framework · 1 control

  • NISTPF-1 Identify-P - Business Environment, Data Processing Inventory, Ecosystem, and Risk Assessment

NIST SP 800-171 · 1 control

  • 3.6.1 Procedures are defined and implemented to protect cryptographic keys used to protect stored account data against disclosure and misuse that include: • Access to keys is restricted to the fewest number of custodians necessary.

NIST SP 800-53 Rev 5 LOW · 1 control

  • CA-9 Internal System Connections

NIST SP 800-53 Rev 5 MODERATE · 1 control

  • CA-9 Internal System Connections

NIST SP 800-53 Revision 5.1 HIGH · 1 control

  • CA-9 Internal System Connections

Notifiable Data Breaches Scheme (Australia) · 1 control

  • AUNDB-A3 Eligible Data Breach Determination and Serious Harm Threshold

OCC Heightened Standards (12 CFR Part 30, Appendix D) · 1 control

  • OCCHS-1 Scope, Applicability, and Definitions of Heightened Standards

OWASP ASVS · 1 control

  • OWASPASVS-1 Architecture, Design and Threat Modelling (V1)

OWASP MASVS · 1 control

OWASP Top 10 for LLM Applications 2025 · 1 control

  • OWASPLLM-3 Sensitive Information Disclosure and Privacy (LLM02)

PCI DSS 4.0 · 1 control

  • 2.2.2 Vendor default accounts are managed as follows: • If the vendor default account(s) will be used, the default password is changed per Requirement 8.3.6. • If the vendor default account(s) will not be used,

Protective Security Policy Framework (PSPF) Release 2024 · 1 control

  • PSPF24-1 Security Culture, Governance, Risk Management

Regulation on the European Health Data Space (EHDS) · 1 control

  • EHDSREG-1 Mandatory Requirements for EHR Systems (Articles 14-29)

Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA) · 1 control

  • RIDTPPA-2 Consumer Rights (Access, Correction, Deletion, Portability, Opt-Out)

SWIFT CSCF · 1 control

  • SWIFTCSCF-1 Restrict Internet Access and Protect Critical Systems (Objective 1)

Singapore Cybersecurity Act 2018 · 1 control

  • SGCYBER-1 Critical Information Infrastructure (CII) Designation and Registration

South Korea Korea Internet Self-Governance Organisation (KISO) Code of Ethics · 1 control

TEFCA - Trusted Exchange Framework and Common Agreement · 1 control

  • TEFCAREC-1 Common Agreement Conformance and Onboarding

Turkey KVKK · 1 control

US Children's Online Privacy Protection Act (COPPA) and COPPA 2.0 Proposed Updates · 1 control

  • USCOPPA-3 Data Minimisation, Retention, Erasure (Eraser Button)

US EPA Safe Drinking Water Act (SDWA) - Cybersecurity Requirements · 1 control

  • USSDWA-2 Cybersecurity Practices (Assessment, Access, Network, IR)

US Foreign Corrupt Practices Act (FCPA) · 1 control

US Gramm-Leach-Bliley Act (GLBA) - Higher Education Safeguards Rule · 1 control

Vermont Artificial Intelligence and Consumer Data Act (AICDA) · 1 control

Voluntary Principles on Security and Human Rights (VPs) · 1 control

  • VPSHR-3 Implementation Guidance and Reporting

W3C Verifiable Credentials (VC) Data Model 2.0 · 1 control

  • W3CVCDM-1 Three-Party Ecosystem (Issuer, Holder, Verifier)

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Query this from an agent

The graph holds this control, the 383 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll Nigeria Data Protection Act 2023 (NDPA) controls