Nigeria Data Protection Regulation (NDPR) and Nigeria Data Protection Act (NDPA)

Nigeria

30 domains

33 controls

Nigeria Data Protection Regulation (NDPR) 2019, which provides initial data protection rules, and the Nigeria Data Protection Act (NDPA) 2023, which supersedes the NDPR and introduces expanded obligations, breach notification, and higher penalties.

Verified

Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (30)

Accountability

1 controls

Controls in the Accountability domain of Nigeria Data Protection Regulation (NDPR) and Nigeria Data Protection Act (NDPA) — 1 controls
Code	Title	Description
NDPA-S33-ACCOUNTABILITY	Accountability and Records (Section 33)	Controllers shall maintain records of processing activities containing name and contact of controller and DPO, purposes,...

Audit

1 controls

Controls in the Audit domain of Nigeria Data Protection Regulation (NDPR) and Nigeria Data Protection Act (NDPA) — 1 controls
Code	Title	Description
NDPR-ART4-AUDIT	Annual Compliance Audit Return (Article 4.1.7)	Data controllers processing personal data of more than 2,000 data subjects in 12 months shall file an annual audit retur...

Automated Processing

1 controls

Controls in the Automated Processing domain of Nigeria Data Protection Regulation (NDPR) and Nigeria Data Protection Act (NDPA) — 1 controls
Code	Title	Description
NDPA-S37-ADM	Automated Decision-Making (Section 37)	A data subject has the right not to be subject to a decision based solely on automated processing, including profiling,...

Children Data

1 controls

Controls in the Children Data domain of Nigeria Data Protection Regulation (NDPR) and Nigeria Data Protection Act (NDPA) — 1 controls
Code	Title	Description
NDPA-S31-CHILDREN	Children and Persons Lacking Capacity (Section 31)	Processing personal data of a child (under 18) or a person lacking legal capacity requires consent of a parent or legal...

Complaints

1 controls

Controls in the Complaints domain of Nigeria Data Protection Regulation (NDPR) and Nigeria Data Protection Act (NDPA) — 1 controls
Code	Title	Description
NDPA-S46-COMPLAINTS	Complaints to the Commission (Section 46)	A data subject who believes their rights have been violated may lodge a complaint with NDPC. The controller shall cooper...

Consent

1 controls

Controls in the Consent domain of Nigeria Data Protection Regulation (NDPR) and Nigeria Data Protection Act (NDPA) — 1 controls
Code	Title	Description
NDPA-S26-CONSENT	Conditions for Valid Consent (Section 26)	Where consent is the lawful basis, it shall be freely given, specific, informed and unambiguous, given by a clear affirm...

DPCO

1 controls

Controls in the DPCO domain of Nigeria Data Protection Regulation (NDPR) and Nigeria Data Protection Act (NDPA) — 1 controls
Code	Title	Description
NDPA-DPCO	Data Protection Compliance Organisation Engagement	Data Controllers of Major Importance must engage NDPC-licensed Data Protection Compliance Organisations (DPCOs) to perfo...

Data Subject Rights

3 controls

Controls in the Data Subject Rights domain of Nigeria Data Protection Regulation (NDPR) and Nigeria Data Protection Act (NDPA) — 3 controls
Code	Title	Description
NDPA-S34-RIGHTS	Data Subject Rights (Section 34-37)	Data subjects have rights to access, rectification, erasure, restriction, objection, portability, and not to be subject...
NDPA-S35-ERASURE	Right to Erasure (Section 35)	Data subjects may request erasure where data is no longer necessary, consent is withdrawn and no other basis exists, the...
NDPA-S38-PORTABILITY	Data Portability (Section 38)	Where processing is based on consent or contract and carried out by automated means, data subjects have the right to rec...

Disclosure

1 controls

Controls in the Disclosure domain of Nigeria Data Protection Regulation (NDPR) and Nigeria Data Protection Act (NDPA) — 1 controls
Code	Title	Description
NDPR-ART2-3RDPARTY	Third-Party Data Sharing Notice (Article 2.11)	Where personal data is to be shared with third parties, the data subject shall be informed of the categories of recipien...

Enforcement

1 controls

Controls in the Enforcement domain of Nigeria Data Protection Regulation (NDPR) and Nigeria Data Protection Act (NDPA) — 1 controls
Code	Title	Description
NDPA-S48-PENALTY	Enforcement and Penalties (Section 48)	For data controllers/processors of major importance, the maximum remedial fee is the greater of NGN 10 million or 2% of...

Governance

1 controls

Controls in the Governance domain of Nigeria Data Protection Regulation (NDPR) and Nigeria Data Protection Act (NDPA) — 1 controls
Code	Title	Description
NDPA-S32-DPO	Data Protection Officer Appointment (Section 32)	Data controllers of major importance shall appoint a Data Protection Officer with expert knowledge of data protection la...

HR Data

1 controls

Controls in the HR Data domain of Nigeria Data Protection Regulation (NDPR) and Nigeria Data Protection Act (NDPA) — 1 controls
Code	Title	Description
NDPA-S43-EMPLOYMENT	Employment Data Processing (Section 43)	Processing employee personal data shall meet a lawful basis, with proportionate monitoring, transparency to staff, and s...

Implementing Rules

1 controls

Controls in the Implementing Rules domain of Nigeria Data Protection Regulation (NDPR) and Nigeria Data Protection Act (NDPA) — 1 controls
Code	Title	Description
NDPA-GAID-2025	General Application and Implementation Directive (GAID) 2025	The NDPC General Application and Implementation Directive 2025 operationalises the NDPA, replacing the NDPR Implementati...

Incident Response

1 controls

Controls in the Incident Response domain of Nigeria Data Protection Regulation (NDPR) and Nigeria Data Protection Act (NDPA) — 1 controls
Code	Title	Description
NDPA-S40-BREACH	Personal Data Breach Notification (Section 40)	A controller shall notify the NDPC within 72 hours of becoming aware of a personal data breach likely to result in risk...

International Transfers

2 controls

Controls in the International Transfers domain of Nigeria Data Protection Regulation (NDPR) and Nigeria Data Protection Act (NDPA) — 2 controls
Code	Title	Description
NDPA-S41-TRANSFER	Cross-Border Transfers Adequacy (Section 41)	Personal data may be transferred outside Nigeria only where the recipient country provides an adequate level of protecti...
NDPA-S42-SAFEGUARDS	Transfer Safeguards and Derogations (Section 42)	Absent adequacy, transfers require safeguards: binding corporate rules, standard contractual clauses, code of conduct or...

Lawful Basis

1 controls

Controls in the Lawful Basis domain of Nigeria Data Protection Regulation (NDPR) and Nigeria Data Protection Act (NDPA) — 1 controls
Code	Title	Description
NDPA-S24-LAWFUL	Lawful Basis for Processing (Section 25)	A data controller or processor shall only process personal data where it has identified a lawful basis: consent, perform...

Marketing

1 controls

Controls in the Marketing domain of Nigeria Data Protection Regulation (NDPR) and Nigeria Data Protection Act (NDPA) — 1 controls
Code	Title	Description
NDPA-S38-OBJECT-MARKETING	Right to Object to Direct Marketing (Section 36)	Data subjects have the absolute right to object to processing for direct marketing purposes, including profiling related...

Principles

1 controls

Controls in the Principles domain of Nigeria Data Protection Regulation (NDPR) and Nigeria Data Protection Act (NDPA) — 1 controls
Code	Title	Description
NDPA-S24-PRINCIPLES	Data Protection Principles (Section 24)	Personal data shall be processed lawfully, fairly and transparently; collected for specified purposes; adequate, relevan...

Privacy by Design

1 controls

Controls in the Privacy by Design domain of Nigeria Data Protection Regulation (NDPR) and Nigeria Data Protection Act (NDPA) — 1 controls
Code	Title	Description
NDPA-DPBP	Privacy by Design and Default (Section 39(3))	Controllers shall implement appropriate technical and organisational measures both at the time of determination of the m...

Public Sector

1 controls

Controls in the Public Sector domain of Nigeria Data Protection Regulation (NDPR) and Nigeria Data Protection Act (NDPA) — 1 controls
Code	Title	Description
NDPR-ART2-LAWFUL-PI	Public Institutions Use of Personal Data (Guideline 2020)	Public institutions processing personal data must comply with NDPR requirements and the 2020 Guideline for the Use of Pe...

Registration

1 controls

Controls in the Registration domain of Nigeria Data Protection Regulation (NDPR) and Nigeria Data Protection Act (NDPA) — 1 controls
Code	Title	Description
NDPA-S44-REG	Registration of Data Controllers/Processors of Major Importance (Section 44)	Controllers or processors of major importance shall register with NDPC within six months of becoming one. NDPC classifie...

Regulator

1 controls

Controls in the Regulator domain of Nigeria Data Protection Regulation (NDPR) and Nigeria Data Protection Act (NDPA) — 1 controls
Code	Title	Description
NDPA-S5-NDPC	Establishment and Functions of NDPC (Section 5)	The Nigeria Data Protection Commission is established as the regulatory authority for data protection in Nigeria. It sup...

Regulator Powers

1 controls

Controls in the Regulator Powers domain of Nigeria Data Protection Regulation (NDPR) and Nigeria Data Protection Act (NDPA) — 1 controls
Code	Title	Description
NDPA-S45-INSPECT	Investigations and Inspections (Section 45)	NDPC may carry out investigations, on its own initiative or on complaint, including inspections, summons, document produ...

Retention

1 controls

Controls in the Retention domain of Nigeria Data Protection Regulation (NDPR) and Nigeria Data Protection Act (NDPA) — 1 controls
Code	Title	Description
NDPA-S24-RETENTION	Retention and Erasure (Section 24(1)(e))	Personal data shall be kept in a form which permits identification of data subjects for no longer than necessary for the...

Risk Assessment

1 controls

Controls in the Risk Assessment domain of Nigeria Data Protection Regulation (NDPR) and Nigeria Data Protection Act (NDPA) — 1 controls
Code	Title	Description
NDPA-S28-DPIA	Data Protection Impact Assessment (Section 28)	Where processing is likely to result in high risk to rights and freedoms, the controller shall conduct a DPIA before pro...

Security

1 controls

Controls in the Security domain of Nigeria Data Protection Regulation (NDPR) and Nigeria Data Protection Act (NDPA) — 1 controls
Code	Title	Description
NDPA-S39-SECURITY	Security of Processing (Section 39)	Controllers and processors shall implement appropriate technical and organisational measures to ensure security of perso...

Special Categories

1 controls

Controls in the Special Categories domain of Nigeria Data Protection Regulation (NDPR) and Nigeria Data Protection Act (NDPA) — 1 controls
Code	Title	Description
NDPA-S30-SENSITIVE	Sensitive Personal Data Processing (Section 30)	Sensitive personal data (genetic, biometric, health, race, religion, sexual orientation, political opinion, trade union...

Third Parties

1 controls

Controls in the Third Parties domain of Nigeria Data Protection Regulation (NDPR) and Nigeria Data Protection Act (NDPA) — 1 controls
Code	Title	Description
NDPA-S29-PROCESSOR	Controller-Processor Contracts (Section 29)	Where a controller engages a processor, processing shall be governed by a written contract binding the processor on subj...

Training

1 controls

Controls in the Training domain of Nigeria Data Protection Regulation (NDPR) and Nigeria Data Protection Act (NDPA) — 1 controls
Code	Title	Description
NDPR-ART3-AWARENESS	Privacy Awareness and Training (Article 3.1.4)	Every data controller shall develop and implement adequate privacy and data protection awareness programs for staff. Tra...

Transparency

1 controls

Controls in the Transparency domain of Nigeria Data Protection Regulation (NDPR) and Nigeria Data Protection Act (NDPA) — 1 controls
Code	Title	Description
NDPA-S27-PRIVACY-NOTICE	Information to Data Subjects (Section 27)	Before or at the time of collection, the controller shall provide the data subject with information including identity o...

Frequently Asked Questions

What is Nigeria Data Protection Regulation (NDPR) and Nigeria Data Protection Act (NDPA)?

Nigeria Data Protection Regulation (NDPR) and Nigeria Data Protection Act (NDPA) is a compliance framework from Nigeria with 30 domains and 33 controls. Nigeria Data Protection Regulation (NDPR) 2019, which provides initial data protection rules, and the Nigeria Data Protection Act (NDPA) 2023, which supersedes the NDPR and introduces expanded obligations, breach notification, and higher penalties. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

How many controls does Nigeria Data Protection Regulation (NDPR) and Nigeria Data Protection Act (NDPA) have?

Nigeria Data Protection Regulation (NDPR) and Nigeria Data Protection Act (NDPA) has 33 controls organised across 30 domains. The largest domains are Data Subject Rights (3 controls), International Transfers (2 controls), Accountability (1 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

What frameworks does Nigeria Data Protection Regulation (NDPR) and Nigeria Data Protection Act (NDPA) map to?

Nigeria Data Protection Regulation (NDPR) and Nigeria Data Protection Act (NDPA) does not currently have cross-framework mappings in our system. Check back as we continuously expand our mapping database.

How do I get started with Nigeria Data Protection Regulation (NDPR) and Nigeria Data Protection Act (NDPA) compliance?

Start your Nigeria Data Protection Regulation (NDPR) and Nigeria Data Protection Act (NDPA) compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about Nigeria Data Protection Regulation (NDPR) and Nigeria Data Protection Act (NDPA) requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 33 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 768 frameworks.

Get Started Free →

Free forever — no credit card required