The Nigeria Data Protection Commission: Powers, Enforcement, and What It Means for Your Business
Nigeria’s data protection landscape changed fundamentally in 2023. The Nigeria Data Protection Act (NDPA) created a dedicated regulatory body with real enforcement authority: the Nigeria Data Protection Commission. The NDPC can audit an organisation’s operations, investigate complaints, issue binding orders, and impose administrative penalties linked to annual gross revenue.
NDPA compliance is now an operational reality for every organisation that collects or processes personal data in Nigeria. This guide covers what the Commission can do, what gets its attention, and what a business needs in place before that attention arrives.
This article is part of PlanetWeb’s GAID compliance series. For the foundational framework, see GAID Nigeria Data Protection Directive: What Every Business Must Know. For a practical guide to employee data obligations, see the Employee Data Protection guide.
What the NDPC Is and Where Its Authority Comes From
The Nigeria Data Protection Commission was established under the Nigeria Data Protection Act 2023, which replaced the Nigeria Data Protection Regulation 2019. The NDPR offered guidance but lacked a dedicated enforcement body. Key Features of the NDPA 2023 covers what the Act introduced in full.
Day to day, the NDPC enforces the Act through the General Application and Implementation Directive (GAID), the detailed operational framework that governs registration, DPO requirements, DPIAs, breach notification, and everything else covered below.
The Commission operates with institutional independence from sector regulators such as the CBN, NITDA, and NCC, setting national data protection policy and enforcing the law across every sector simultaneously. Nigeria Data Regulators Guide covers how the NDPC’s role sits alongside those sector-specific bodies.
Who Must Comply
The NDPA has broad territorial scope. It applies to organisations domiciled, resident, or operating in Nigeria; organisations processing personal data in Nigeria; and certain organisations outside Nigeria that process the personal data of data subjects in Nigeria.
This covers Nigerian-registered organisations of every type, private companies, NGOs, government agencies, and sole traders, and it can extend to foreign organisations processing personal data about Nigerian residents.
The NDPA applies broadly, but a smaller subset carries the heaviest obligations.
Organisations classified as Data Controllers or Processors of Major Importance (DCPMIs) must register, appoint a Data Protection Officer (DPO), and file a Compliance Audit Return (CAR), while other organisations do not.
DCPMI status itself has three tiers, Ultra-High Level (UHL), Extra-High Level (EHL), and Ordinary-High Level (OHL), based broadly on how much personal data an organisation processes and how sensitive it is.
Which tier applies determines exactly which obligations below kick in: registration fees, whether a DPO is required, and whether the organisation files an annual CAR or simply renews its registration. GAID Registration in Nigeria covers the exact thresholds, tiers, and fees in full.
The NDPC’s Enforcement Powers
The Commission has a full suite of enforcement tools and has demonstrated a willingness to use them.
| Power | What It Means |
|---|---|
| Investigations and audits | Can act on its own motion, including sector-wide sweeps, without waiting for a complaint |
| Enforcement notices | Binding orders requiring an organisation to change or stop specific processing, with remediation deadlines |
| Administrative fines | Up to the greater of β¦10 million or 2% of annual gross revenue for DCPMIs, β¦2 million or 2% for others |
| Processing restrictions | Can restrict, suspend, or prohibit specific processing activities where authorised under the Act or GAID |
| Public naming | Non-compliant organisations can be publicly identified, separate from any financial penalty |
Investigations and Audits
The NDPC can initiate an investigation on its own motion without waiting for a complaint, and its regulatory programme can include sector-wide compliance activity. Individual audits can be triggered by a breach notification, a data subject complaint, or a referral from another regulator.
Organisations should also have a functioning grievance-handling process. GAID provides a standardised route for this, the SNAG process (Standard Notice to Address Grievance), through which a data subject can raise a complaint directly with an organisation before or alongside escalating to the NDPC.
Obstruction or delay during an NDPC investigation does not improve an organisation’s position.
Enforcement Notices
Where an investigation identifies a breach of the Act, the NDPC can issue a binding enforcement notice requiring the organisation to change or stop specific processing activities, with remediation steps due within defined timeframes.
The Commission may consider cooperation and documented remediation when determining the proportionality of any sanction.
Administrative Fines
Under Section 48 of the NDPA, the statutory maximum is tiered: a DCPMI faces the greater of β¦10 million or 2% of annual gross revenue, while other organisations face the greater of β¦2 million or 2%. Those are ceilings, not the penalty automatically applied to every case.
What the NDPC has imposed in practice shows the framework is live, not theoretical. The Commission fined MultiChoice Nigeria β¦766,242,500 in July 2025 and Fidelity Bank β¦555.8 million in August 2024, both for broader NDPA non-compliance rather than a single narrow violation.
Processing Restrictions
Beyond fines, the NDPC can restrict, suspend, or prohibit data processing activities where authorised under the Act or GAID. For a business whose operations depend on processing customer data, a fintech, a logistics platform, or an e-commerce business, a processing restriction can be more damaging than a monetary penalty.
Public Naming
Non-compliant organisations can be publicly identified by the NDPC. The reputational consequence sits separately from any financial penalty and carries real commercial weight in Nigeria’s connected business environment.
What Triggers NDPC Attention
Managing enforcement risk starts with knowing what draws the Commission’s attention in the first place, distinct from what it can do once it is already looking.
Data breach notifications. Organisations must self-report notifiable breaches within 72 hours. A failure to report is itself a violation, and a report revealing inadequate security measures tends to attract a wider investigation.
Data subject complaints. Any individual can file a complaint directly with the NDPC, at no cost. Former employees, customers, and business partners are all potential complainants.
Sector sweeps. The NDPC has indicated priority attention on fintech, healthcare, financial services, and any sector handling sensitive personal data at scale. Businesses in these sectors should assume periodic scrutiny rather than wait for a specific trigger.
Referrals from other regulators. The CBN, NITDA, and NCC can refer matters to the NDPC where data protection issues arise, a real exposure for financial services and telecoms operators in particular.
Registration failures. Organisations required to register that have not done so are non-compliant before any substantive issue arises, and the NDPC publishes DCPMI records through its information portal.
DPCO Registration: What It Is and Whether You Need It
A Data Protection Compliance Organisation is a private body licensed by the NDPC to provide certain professional compliance services on an organisation’s behalf, conducting audits, supporting registration and CAR filing, and providing a Data Protection Officer as a service. DPCOs are a formal part of the NDPC’s regulatory architecture, not an optional intermediary layer.
DPCO licensing and DPO certification are two separate things Nigerian businesses commonly conflate. A DPCO is licensed as a firm to provide these services; the individual acting as an organisation’s DPO, whether employed directly or supplied through a DPCO, needs their own certification under GAID.
Data Protection Officers in Nigeria covers that distinction, certification, and independence requirements in full.
For UHL and EHL organisations, working with a licensed DPCO is required for CAR filing and can also provide practical support with registration and ongoing compliance. OHL organisations do not carry the same requirement.
The NDPC maintains a licensed DPCO register on its official website; due diligence before appointing one is worthwhile.
Compliance Audit Returns: The Recurring Obligation
Registration is not the end of the relationship with the NDPC. UHL and EHL organisations file an annual Compliance Audit Return through a licensed DPCO; the standing deadline is 31 March each year.
Organisations established after 12 June 2023 have 15 months from establishment before their first CAR is due, after which annual filing applies. OHL organisations renew their registration annually instead and do not file a CAR.
The standing deadline moves in practice: the NDPC extended the 2025 Compliance Audit Return filing window to 30 May 2026.
Missing the CAR deadline attracts a penalty of 50% of the filing fee. A registration certificate on file is not evidence of ongoing compliance if nothing has been filed since.
The 72-Hour Breach Notification Obligation
Section 40 of the NDPA requires organisations to notify the NDPC within 72 hours of becoming aware of a personal data breach likely to result in a risk to the rights and freedoms of data subjects. A higher threshold, high risk, applies separately to notifying the affected individuals directly.
The clock starts when the organisation becomes aware of the breach, not when its investigation is complete, and an initial notification with a commitment to follow up is acceptable where the full picture is not yet known.
The notification itself should cover the nature of the breach, the categories and approximate number of data subjects affected, the contact details of the DPO or other contact point, the likely consequences, and the measures taken or proposed.
Missing the window does not remove the obligation to report; late notification with a clear explanation is better than none. Responding to Data Breaches in Nigeria covers the full response process, the breach register, and preparation in depth. Breaches can also be reported directly to the NDPC.
How to Engage with the NDPC Proactively
Enforcement is not the only dynamic here. Proactive compliance gives an organisation evidence that its controls are operating before the Commission asks for it.
Appoint a Certified Data Protection Officer
A Data Protection Officer (DPO) is the person responsible for an organisation’s data protection compliance: monitoring how personal data is handled, advising on obligations, and acting as the main point of contact for both data subjects and the NDPC. A DPO is mandatory for organisations classified as DCPMIs.
What matters goes beyond whether someone holds the title: the DPO must meet the independence requirements and have the required certification, which is verified as part of CAR filing or registration.
Data Protection Officers in Nigeria covers the appointment, independence, and certification requirements in full.
Maintain a Record of Processing Activities
Organisations should be able to produce their Record of Processing Activities (ROPA) when required, a documented inventory of what data is collected, why, on what lawful basis, where it is stored, who has access, and how long it is kept.
An organisation that cannot produce one may indicate that its compliance programme is not being maintained in practice. Data Protection Compliance Strategies covers how to build one that holds up under scrutiny.
Conduct Data Protection Impact Assessments
A Data Protection Impact Assessment (DPIA) is a structured risk assessment GAID requires before certain high-risk processing activities begin, evaluating what data is collected, what could go wrong for the people affected, and what safeguards address that risk.
Where GAID requires a DPIA, the NDPC expects to see that the organisation identified the trigger and completed the assessment before the relevant processing began, not after.
An organisation under investigation that can produce a signed, dated DPIA for the processing in question is in a materially different position than one that cannot. Data Protection Impact Assessments in Nigeria covers the full trigger list and process.
Respond to Investigations Cooperatively
When the NDPC initiates contact, whether through a routine audit, a breach investigation, or a complaint, the organisation’s response shapes the outcome.
Cooperation, prompt production of records, and documented remediation can help demonstrate how the organisation responded once an issue was identified, compared with an organisation that resists, delays, or provides incomplete responses. Engaging professionally and meeting deadlines is not the same as accepting findings the organisation disagrees with.
Common Compliance Gaps the NDPC Looks For
Gaps often surface once an investigation is already under way, particularly where an organisation has not built the infrastructure the law requires.
Outdated ROPA
A ROPA that was built once for a compliance exercise and never updated is often worse than no ROPA at all; it raises questions about what else is not being managed properly.
Missing Privacy Notice
No privacy notice on the organisation’s website is a baseline gap visible to any regulator who visits the site. A notice that exists but no longer reflects actual processing activities, referencing outdated purposes or missing newer data collection points, carries much the same risk: it signals the same gap between documentation and practice as an outdated ROPA.
No Documented Breach Procedure
An organisation discovering a breach with no process for assessing, containing, and notifying it faces an increased risk of missing the 72-hour notification window.
Consent Used as a Blanket Lawful Basis
Relying on consent for all processing, including processing where consent is not the appropriate basis, is another recurring pattern. Data Subject Rights in Nigeria covers what happens when an organisation’s lawful basis fails to hold up.
DPO in Title Only
A DPO appointed for the title, without genuine independence or the required Commission certification, does not satisfy the requirement. It is one of the more common gaps an investigation uncovers, precisely because the appointment looks complete on paper.
Get Help With NDPC Compliance
Our IT consulting work covers building the compliance infrastructure the NDPC looks for in practice, from registration and DPO placement to ROPA development and breach response planning. Get in touch to talk through where your organisation stands.
