Back to Frameworks

Nigeria Data Protection Act 2023 (NDPA)

Self-Assess
Nigeria
vAct No. 37 of 2023 (assented 12 June 2023); GAID 2025
6 domains
28 controls

Nigeria's data protection statute (Act No. 37 of 2023, assented 12 June 2023), replacing the NITDA Data Protection Regulation 2019 regime and establishing the Nigeria Data Protection Commission: six processing principles with a duty of care and accountability, six lawful bases with a legitimate-interest test, consent rules with the burden of proof on the controller, privacy notices, data privacy impact assessments with prior consultation, processor contracts, sensitive personal data grounds, parental consent for children under 18, mandatory DPOs and registration for data controllers and processors of major importance, the rights of access, correction, erasure, restriction, objection, withdrawal, automated decision-making safeguards and portability, risk-based security, 72-hour breach notification to the Commission and communication to data subjects, cross-border transfer on adequacy or listed conditions, and Commission investigation, compliance and enforcement orders with penalties up to the greater of NGN 10 million and 2 percent of annual gross revenue. Implemented by the NDPC General Application and Implementation Directive 2025.

Verified

Nigeria Data Protection Act 2023 (NDPA) is a compliance framework from Nigeria with 6 domains and 28 controls that map to 146 other frameworks. The largest domains are Part V: Principles and lawful basis governing processing of personal data – Nigeria Data Protection Act 2023 (NDPA) (9 controls), Part VII: Data security – Nigeria Data Protection Act 2023 (NDPA) (6 controls), Part VI: Rights of a data subject – Nigeria Data Protection Act 2023 (NDPA) (5 controls). Every control below carries what it requires and what an assessor expects to see.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (6)

Part IX: Registration and fees – Nigeria Data Protection Act 2023 (NDPA)

2 controls
Controls in the Part IX: Registration and fees – Nigeria Data Protection Act 2023 (NDPA) domain of Nigeria Data Protection Act 2023 (NDPA): 2 controls
CodeTitle
nigeria-data-protection-act-2023-ndpa::44(1)-(2)Registration of data controllers and data processors of major importance
nigeria-data-protection-act-2023-ndpa::44(3)Notification of significant changes to registration

Part V: Principles and lawful basis governing processing of personal data – Nigeria Data Protection Act 2023 (NDPA)

9 controls
Controls in the Part V: Principles and lawful basis governing processing of personal data – Nigeria Data Protection Act 2023 (NDPA) domain of Nigeria Data Protection Act 2023 (NDPA): 9 controls
CodeTitle
nigeria-data-protection-act-2023-ndpa::24Principles of personal data processing
nigeria-data-protection-act-2023-ndpa::25Lawful basis of personal data processing
nigeria-data-protection-act-2023-ndpa::26Consent
nigeria-data-protection-act-2023-ndpa::27Provision of information to the data subject
nigeria-data-protection-act-2023-ndpa::28Data privacy impact assessment
nigeria-data-protection-act-2023-ndpa::29Obligations of the data controller and data processor when engaging a processor
nigeria-data-protection-act-2023-ndpa::30Sensitive personal data
nigeria-data-protection-act-2023-ndpa::31Children or persons lacking the legal capacity to consent
nigeria-data-protection-act-2023-ndpa::32Data Protection Officers

Part VI: Rights of a data subject – Nigeria Data Protection Act 2023 (NDPA)

5 controls
Controls in the Part VI: Rights of a data subject – Nigeria Data Protection Act 2023 (NDPA) domain of Nigeria Data Protection Act 2023 (NDPA): 5 controls
CodeTitle
nigeria-data-protection-act-2023-ndpa::34Rights of a data subject: access, copy, correction, erasure and restriction
nigeria-data-protection-act-2023-ndpa::35Withdrawal of consent
nigeria-data-protection-act-2023-ndpa::36Right to object
nigeria-data-protection-act-2023-ndpa::37Automated decision making
nigeria-data-protection-act-2023-ndpa::38Data portability

Part VII: Data security – Nigeria Data Protection Act 2023 (NDPA)

6 controls
Controls in the Part VII: Data security – Nigeria Data Protection Act 2023 (NDPA) domain of Nigeria Data Protection Act 2023 (NDPA): 6 controls
CodeTitle
nigeria-data-protection-act-2023-ndpa::39Security, integrity and confidentiality
nigeria-data-protection-act-2023-ndpa::40(1)Breach notification by a data processor to the controller
nigeria-data-protection-act-2023-ndpa::40(2)Breach notification to the Commission within 72 hours
nigeria-data-protection-act-2023-ndpa::40(3)Communication of a breach to data subjects
nigeria-data-protection-act-2023-ndpa::40(4)Content of breach notifications and communications
nigeria-data-protection-act-2023-ndpa::40(8)Record of personal data breaches

Part VIII: Cross-border transfers of personal data – Nigeria Data Protection Act 2023 (NDPA)

3 controls
Controls in the Part VIII: Cross-border transfers of personal data – Nigeria Data Protection Act 2023 (NDPA) domain of Nigeria Data Protection Act 2023 (NDPA): 3 controls
CodeTitle
nigeria-data-protection-act-2023-ndpa::41Basis for cross-border transfer of personal data
nigeria-data-protection-act-2023-ndpa::42Adequacy of protection
nigeria-data-protection-act-2023-ndpa::43Other bases for transfer of personal data outside Nigeria

Part X: Enforcement – Nigeria Data Protection Act 2023 (NDPA)

3 controls
Controls in the Part X: Enforcement – Nigeria Data Protection Act 2023 (NDPA) domain of Nigeria Data Protection Act 2023 (NDPA): 3 controls
CodeTitle
nigeria-data-protection-act-2023-ndpa::46Complaints and investigations: cooperation with the Commission
nigeria-data-protection-act-2023-ndpa::47Compliance orders
nigeria-data-protection-act-2023-ndpa::53Joint and vicarious liability

Your Compliance Coverage

If you comply with Nigeria Data Protection Act 2023 (NDPA), you already cover:

Nebraska Data Privacy Act

22%

8 controls mapped

Compare →

Vietnam Law on Cybersecurity (No. 116/2025/QH15)

19%

7 controls mapped

Compare →

Turkey KVKK

19%

7 controls mapped

Compare →

+ 143 more: Privacy Act 1988 (Australia) (19%), Pakistan Personal Data Protection Bill 2023 (19%)

See all 146 mapped frameworks ↓

Maps to 146 other frameworks

36 total controls
Nebraska Data Privacy Act
8 source controls mapped|8 target controls covered
22%
Vietnam Law on Cybersecurity (No. 116/2025/QH15)
7 source controls mapped|3 target controls covered
19%
Turkey KVKK
7 source controls mapped|3 target controls covered
19%
Privacy Act 1988 (Australia)
7 source controls mapped|7 target controls covered
19%
Pakistan Personal Data Protection Bill 2023
7 source controls mapped|5 target controls covered
19%
Switzerland New Federal Act on Data Protection (nFADP/nDSG, 2023)
7 source controls mapped|24 target controls covered
19%
South Korea PIPA
7 source controls mapped|5 target controls covered
19%
FTC GLBA Safeguards Rule (16 CFR Part 314)
7 source controls mapped|3 target controls covered
19%
NIST SP 800-124 Revision 2 - Guidelines for Managing the Security of Mobile Devices
7 source controls mapped|6 target controls covered
19%
Singapore Government Instruction Manual on ICT&SS Management (IM8)
7 source controls mapped|10 target controls covered
19%
Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL)
7 source controls mapped|9 target controls covered
19%
UK Defence Standard 05-138 - Cyber Security for Defence Suppliers
7 source controls mapped|3 target controls covered
19%
ISO/IEC 27400:2022
7 source controls mapped|8 target controls covered
19%
Bahrain PDPL
7 source controls mapped|13 target controls covered
19%
ASD Strategies to Mitigate Cyber Security Incidents
7 source controls mapped|4 target controls covered
19%
Barbados Data Protection Act 2019
7 source controls mapped|8 target controls covered
19%
Vermont Data Privacy and Online Surveillance Act
6 source controls mapped|3 target controls covered
17%
US Gramm-Leach-Bliley Act (GLBA) - Higher Education Safeguards Rule
6 source controls mapped|4 target controls covered
17%
TEFCA - Trusted Exchange Framework and Common Agreement
6 source controls mapped|1 target controls covered
17%
Russia Federal Law on Personal Data (152-FZ)
6 source controls mapped|2 target controls covered
17%
Nigeria Data Protection Regulation (NDPR)
6 source controls mapped|6 target controls covered
17%
Azerbaijan Law on Personal Data (2010)
6 source controls mapped|5 target controls covered
17%
GDPR
6 source controls mapped|10 target controls covered
17%
APPI
6 source controls mapped|9 target controls covered
17%
Albania Law No. 124/2024 on Personal Data Protection
6 source controls mapped|5 target controls covered
17%
AWWA Cybersecurity Guidance for the Water Sector (American Water Works Association)
6 source controls mapped|6 target controls covered
17%
Austria Data Protection Act (Datenschutzgesetz, DSG, amended 2018)
6 source controls mapped|8 target controls covered
17%
ISO/IEC 23894:2023
6 source controls mapped|8 target controls covered
17%
South Korea ISMS-P
6 source controls mapped|8 target controls covered
17%
Florida Digital Bill of Rights (FDBR)
6 source controls mapped|3 target controls covered
17%
ISO/IEC 27011:2024
6 source controls mapped|8 target controls covered
17%
Nevada Gaming Control Board Cybersecurity Requirements
6 source controls mapped|5 target controls covered
17%
COSO Internal Control - Integrated Framework (2013)
6 source controls mapped|2 target controls covered
17%
CISA Cross-Sector Cybersecurity Performance Goals (CPG) 2.0
6 source controls mapped|6 target controls covered
17%
USMCA Chapter 19 - Digital Trade (United States-Mexico-Canada Agreement)
5 source controls mapped|2 target controls covered
14%
Regulation on the European Health Data Space (EHDS)
5 source controls mapped|4 target controls covered
14%
Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA)
5 source controls mapped|1 target controls covered
14%
OWASP Top 10:2025
5 source controls mapped|4 target controls covered
14%
OWASP Top 10 for LLM Applications 2025
5 source controls mapped|1 target controls covered
14%
OWASP DevSecOps Maturity Model (DSOMM)
5 source controls mapped|5 target controls covered
14%
Notifiable Data Breaches Scheme (Australia)
5 source controls mapped|1 target controls covered
14%
NIST Special Publication 800-34 Revision 1, Contingency Planning Guide for Federal Information Systems
5 source controls mapped|3 target controls covered
14%
NIST Privacy Framework
5 source controls mapped|1 target controls covered
14%
US Consumer Product Safety Act (CPSC) Manufacturer and Importer Duties
5 source controls mapped|4 target controls covered
14%
Annex 11 to EU GMP - Computerised Systems
5 source controls mapped|6 target controls covered
14%
EASA Part-IS - Information Security in Aviation
5 source controls mapped|5 target controls covered
14%
ISO/IEC 27557:2022 - Organisational Privacy Risk Management
5 source controls mapped|5 target controls covered
14%
FFIEC IT Examination Handbook
5 source controls mapped|6 target controls covered
14%
ASIS SPC.1-2009 - Organizational Resilience Standard
5 source controls mapped|3 target controls covered
14%
BSI IT-Grundschutz
5 source controls mapped|10 target controls covered
14%
ISO/IEC 29100:2024
5 source controls mapped|6 target controls covered
14%
DAMA-DMBOK2 - Data Management Body of Knowledge (2nd Edition)
5 source controls mapped|6 target controls covered
14%
ISO/IEC 27019:2024
5 source controls mapped|7 target controls covered
14%
API 1164
5 source controls mapped|7 target controls covered
14%
ISO/IEC 29134:2023
5 source controls mapped|3 target controls covered
14%
ISO 27799:2025
5 source controls mapped|9 target controls covered
14%
IEC 62443
5 source controls mapped|7 target controls covered
14%
Armenia Law on Protection of Personal Data (2015)
5 source controls mapped|3 target controls covered
14%
Australian Privacy Principles (APPs)
5 source controls mapped|4 target controls covered
14%
IAEA Nuclear Security Series - Computer Security at Nuclear Facilities (NSS-17-T Rev 1)
5 source controls mapped|5 target controls covered
14%
Azure Security Benchmark
5 source controls mapped|1 target controls covered
14%
ITU-T X.805 - Security Architecture for End-to-End Communications
5 source controls mapped|2 target controls covered
14%
Connecticut Data Privacy Act (CTDPA)
5 source controls mapped|1 target controls covered
14%
ISO/IEC 27010:2015
5 source controls mapped|4 target controls covered
14%
Estonia Personal Data Protection Act (Isikuandmete kaitse seadus, 2019)
5 source controls mapped|1 target controls covered
14%
APRA CPS 230 Operational Risk Management
5 source controls mapped|2 target controls covered
14%
Voluntary Principles on Security and Human Rights (VPs)
4 source controls mapped|1 target controls covered
11%
US Maritime Transportation Security Act (MTSA) and USCG Cybersecurity Requirements
4 source controls mapped|2 target controls covered
11%
US EPA Safe Drinking Water Act (SDWA) - Cybersecurity Requirements
4 source controls mapped|1 target controls covered
11%
Singapore Cybersecurity Act 2018
4 source controls mapped|1 target controls covered
11%
Protective Security Policy Framework (PSPF) Release 2026
4 source controls mapped|3 target controls covered
11%
PCAOB AS 2201 - Audit of Internal Control Over Financial Reporting (ICFR)
4 source controls mapped|4 target controls covered
11%
OWASP MASVS
4 source controls mapped|4 target controls covered
11%
OWASP ASVS
4 source controls mapped|5 target controls covered
11%
NIST Post-Quantum Cryptography Standards (FIPS 203, 204, 205)
4 source controls mapped|5 target controls covered
11%
ISO 22320:2018
4 source controls mapped|6 target controls covered
11%
ISO/IEC 30111:2019
4 source controls mapped|3 target controls covered
11%
Canada ITSG-33 - IT Security Risk Management
4 source controls mapped|1 target controls covered
11%
FFIEC Cybersecurity Assessment Tool (CAT)
4 source controls mapped|3 target controls covered
11%
IAIS Insurance Core Principles (ICPs)
4 source controls mapped|2 target controls covered
11%
ISO/SAE 21434
4 source controls mapped|8 target controls covered
11%
FedRAMP High
4 source controls mapped|2 target controls covered
11%
FedRAMP Moderate
4 source controls mapped|2 target controls covered
11%
NATO STANAG 4774 (Confidentiality Metadata Labels) and STANAG 4778 (Metadata Binding)
4 source controls mapped|2 target controls covered
11%
ISO/IEC 27043:2015
4 source controls mapped|8 target controls covered
11%
ISO/IEC 25012:2008 - Data Quality Model
4 source controls mapped|3 target controls covered
11%
FedRAMP Rev 5
4 source controls mapped|5 target controls covered
11%
APRA CPS 234
4 source controls mapped|2 target controls covered
11%
IEC 62351 - Power Systems Communication Security
4 source controls mapped|3 target controls covered
11%
ISO/IEC 29147:2018
4 source controls mapped|3 target controls covered
11%
ITIL 4
4 source controls mapped|2 target controls covered
11%
ISO/IEC 20000-1:2018
4 source controls mapped|2 target controls covered
11%
ISO 28001:2007 Supply Chain Security Management
4 source controls mapped|3 target controls covered
11%
ISO 8000 - Data Quality
4 source controls mapped|3 target controls covered
11%
ISO/IEC 27031:2011
4 source controls mapped|2 target controls covered
11%
French Sapin II Law (Law No. 2016-1691)
4 source controls mapped|3 target controls covered
11%
ISO/IEC 23837:2023
4 source controls mapped|4 target controls covered
11%
ISO 26262:2018 - Functional Safety for Road Vehicles
4 source controls mapped|2 target controls covered
11%
Kuwait National Cybersecurity Framework
4 source controls mapped|2 target controls covered
11%
ISO/IEC 27003:2017
4 source controls mapped|2 target controls covered
11%
ISO/IEC 29115:2013 - Entity Authentication Assurance Framework
4 source controls mapped|2 target controls covered
11%
New Hampshire Data Privacy Act
4 source controls mapped|4 target controls covered
11%
New Jersey Data Privacy Act
4 source controls mapped|4 target controls covered
11%
ISO 26000:2010
4 source controls mapped|1 target controls covered
11%
South Korea Korea Internet Self-Governance Organisation (KISO) Code of Ethics
4 source controls mapped|1 target controls covered
11%
W3C Verifiable Credentials (VC) Data Model 2.0
3 source controls mapped|1 target controls covered
8%
SWIFT CSCF
3 source controls mapped|1 target controls covered
8%
OWASP API Security Top 10 - 2023
3 source controls mapped|2 target controls covered
8%
OCC Heightened Standards (12 CFR Part 30, Appendix D)
3 source controls mapped|1 target controls covered
8%
ISO 20400:2017 - Sustainable Procurement
3 source controls mapped|2 target controls covered
8%
Automotive SPICE (ASPICE) v4.1 - Process Assessment Model
3 source controls mapped|2 target controls covered
8%
IEC 60601-1 - Medical Electrical Equipment Safety
3 source controls mapped|2 target controls covered
8%
ISO/IEC 27014:2020
3 source controls mapped|2 target controls covered
8%
ISO 15189:2022 - Medical Laboratories Requirements for Quality and Competence
3 source controls mapped|3 target controls covered
8%
IATA Operational Safety Audit (IOSA) Standards Manual
3 source controls mapped|2 target controls covered
8%
ISO/IEC 27004:2016
3 source controls mapped|3 target controls covered
8%
US Foreign Corrupt Practices Act (FCPA)
3 source controls mapped|1 target controls covered
8%
ICH Q10 - Pharmaceutical Quality System
3 source controls mapped|2 target controls covered
8%
ISO 19650 - Organisation and Digitisation of Information about Buildings and Civil Engineering Works (BIM)
3 source controls mapped|3 target controls covered
8%
IEC 62304:2015 Medical Device Software Lifecycle Processes
3 source controls mapped|3 target controls covered
8%
DFARS 252.204-7012 - Safeguarding Covered Defense Information
3 source controls mapped|1 target controls covered
8%
ISO/IEC 27050-1:2019
3 source controls mapped|1 target controls covered
8%
Science Based Targets Initiative (SBTi) - Net-Zero Standard
3 source controls mapped|2 target controls covered
8%
PCI DSS 4.0
3 source controls mapped|1 target controls covered
8%
ICAO Annex 17 - Aviation Security (AVSEC)
3 source controls mapped|2 target controls covered
8%
COBIT 2019
3 source controls mapped|1 target controls covered
8%
ISO 14064 - Greenhouse Gas Accounting and Verification (Parts 1-3)
3 source controls mapped|1 target controls covered
8%
ISO/IEC 27007:2020
3 source controls mapped|1 target controls covered
8%
ISO 41001:2018 - Facility Management Systems
3 source controls mapped|2 target controls covered
8%
ISO/IEC 17025:2017 - General Requirements for Testing and Calibration
3 source controls mapped|2 target controls covered
8%
ISO 56002
3 source controls mapped|2 target controls covered
8%
Illinois Biometric Information Privacy Act (BIPA)
3 source controls mapped|1 target controls covered
8%
ISO 22000:2018
3 source controls mapped|2 target controls covered
8%
Latvia Personal Data Processing Law (Fizisko personu datu apstrades likums, 2018)
2 source controls mapped|1 target controls covered
6%
Section 508 - ICT Accessibility (Revised)
2 source controls mapped|2 target controls covered
6%
UAE Virtual Asset Regulatory Authority (VARA) Regulations
2 source controls mapped|2 target controls covered
6%
FIDO2 / WebAuthn
2 source controls mapped|1 target controls covered
6%
AML/CTF Act 2006 (Australia)
2 source controls mapped|1 target controls covered
6%
FBI CJIS Security Policy
2 source controls mapped|3 target controls covered
6%
SQF Code Edition 9 - Safe Quality Food
2 source controls mapped|2 target controls covered
6%
ISO 22313:2020 - Guidance on Business Continuity Management Systems
2 source controls mapped|1 target controls covered
6%
Singapore AI Governance Framework
2 source controls mapped|1 target controls covered
6%
ISO 14001:2015
2 source controls mapped|1 target controls covered
6%
ISO 45001:2018
2 source controls mapped|1 target controls covered
6%
New Zealand Information Security Manual (NZISM)
1 source controls mapped|1 target controls covered
3%
NERC CIP
1 source controls mapped|1 target controls covered
3%
Compare Nigeria Data Protection Act 2023 (NDPA) with Nebraska Data Privacy Act

Coverage is not the same as your position

This page shows what Nigeria Data Protection Act 2023 (NDPA) overlaps with in general. Where your organisation actually stands, against the standard you are going for and the certifications you already hold, is a different question. Same graph and the same recorded refutations, scoped to you rather than to a pair.

The Compliance Position Diagnostic, $5,000 fixed, ten business days

What is Nigeria Data Protection Act 2023 (NDPA) and who does it apply to?

Nigeria Data Protection Act 2023 (NDPA) is a compliance framework from Nigeria with 6 domains and 28 controls. Nigeria's data protection statute (Act No. 37 of 2023, assented 12 June 2023), replacing the NITDA Data Protection Regulation 2019 regime and establishing the Nigeria Data Protection Commission: six processing principles with a duty of care and accountability, six lawful bases with a legitimate-interest test, consent rules with the burden of proof on the controller, privacy notices, data privacy impact assessments with prior consultation, processor contracts, sensitive personal data grounds, parental consent for children under 18, mandatory DPOs and registration for data controllers and processors of major importance, the rights of access, correction, erasure, restriction, objection, withdrawal, automated decision-making safeguards and portability, risk-based security, 72-hour breach notification to the Commission and communication to data subjects, cross-border transfer on adequacy or listed conditions, and Commission investigation, compliance and enforcement orders with penalties up to the greater of NGN 10 million and 2 percent of annual gross revenue. Implemented by the NDPC General Application and Implementation Directive 2025. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

What does Nigeria Data Protection Act 2023 (NDPA) actually require?

Nigeria Data Protection Act 2023 (NDPA) has 28 controls organised across 6 domains. The largest domains are Part V: Principles and lawful basis governing processing of personal data – Nigeria Data Protection Act 2023 (NDPA) (9 controls), Part VII: Data security – Nigeria Data Protection Act 2023 (NDPA) (6 controls), Part VI: Rights of a data subject – Nigeria Data Protection Act 2023 (NDPA) (5 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

If I already comply with another framework, how much of Nigeria Data Protection Act 2023 (NDPA) do I already cover?

Nigeria Data Protection Act 2023 (NDPA) maps to 146 other compliance frameworks. The top mapping partners are Nebraska Data Privacy Act (22% coverage), Vietnam Law on Cybersecurity (No. 116/2025/QH15) (19% coverage), Turkey KVKK (19% coverage). Use our comparison tool to explore control-level mappings between frameworks.

How do I implement Nigeria Data Protection Act 2023 (NDPA)?

Start your Nigeria Data Protection Act 2023 (NDPA) compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about Nigeria Data Protection Act 2023 (NDPA) requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 28 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,120 frameworks.

Get Started Free →

Free forever, no credit card required