Clym Logo
NG flagNG

Nigeria Data Protection Act (NDPA): Complete Compliance Guide

Overview

The Nigeria Data Protection Act (NDPA)  enacted on 12 June 2023, establishes a legal framework for the protection of personal data and creates the Nigeria Data Protection Commission (NDPC) to regulate data processing activities. The Act ensures fair, lawful, and accountable processing of personal data, strengthens data subject rights, and enforces compliance measures.

Consumer Rights

Nigeria Consumer Rights Under the NDPA

The NDPA grants five individual privacy rights to Nigeria residents. Businesses must respond to authenticated requests within 30 days. A 30-day extension is available with written notice to the consumer.

Find out about your data

Request access to the information we have collected about you

30-day response window
Update your data

Correct inaccurate or incomplete information we have collected about you

30-day response window
Delete your data

Delete personal information we have collected about you

30-day response window
Receive a copy

Request a copy of personal information we have collected about you

30-day response window
Stop processing

Let us know that you don't want us to process your personal information

30-day response window
Clym for NDPA Compliance

How Clym Helps You Comply with the Nigeria Data Protection Act

Consent ManagementNDPA-Compliant Cookie Banner

Configurable consent banner that asks for opt-in consent before non-essential cookies run, and a full consent audit log.

Consumer RightsAutomated DSR Management

Clym's Data Subject Request portal handles every NDPA request type, with built-in 30-day deadline tracking and escalation alerts.

Privacy NoticeAuto-Generated Privacy Notice

Clym scans your site and generates your NDPA-compliant privacy notice, updated automatically when new trackers or data categories are detected.

Book a demoStart free trial — no credit card

Regulation Summary

  • 12 June 2023 – Law enacted and signed by the President.
  • 1 July 2023 – Law published in the Federal Republic of Nigeria Official Gazette.

  • Any organization operating in Nigeria that processes personal data.
  • International companies processing the personal data of individuals in Nigeria.
  • Data controllers and data processors that collect, store, or analyze personal information.
  • Organizations of major importance handling large-scale or sensitive personal data.

  • Personal or household use of data.
  • Government agencies handling criminal investigations, national security, or public health emergencies.
  • Journalistic, educational, artistic, or literary purposes, provided that fundamental rights are not violated.

  • Obtain explicit consent before processing personal data.
  • Ensure transparency by informing data subjects of processing purposes.
  • Implement security measures to protect data from breaches.
  • Limit data processing to specific, lawful purposes.
  • Appoint a Data Protection Officer (DPO) if classified as an organization of major importance.
  • Maintain records of processing activities for compliance audits.

  • Cookie Consent: Obtain explicit user consent for non-essential cookies.
  • Privacy Policy: Publish a notice covering:
    • Types of data collected
    • Processing purposes and retention periods
    • Third-party data sharing practices
    • User rights and how to exercise them
  • Data Security: Encrypt transmitted user data (e.g., contact forms, payments).
  • Right to Deletion: Provide an option for users to request deletion of their data.

  • Cross-Border Data Transfers: Allowed only if the recipient country has adequate data protection laws.
  • Data Breach Notification: Must be reported to the NDPC within 72 hours.
  • Compliance Audits: Organizations must undergo regular audits to verify compliance.
  • Sensitive Data Protection: Stricter measures for processing biometric, health, and financial data.

  • Access: Individuals can request a copy of their personal data.
  • Correction: Users can request rectification of inaccurate data.
  • Deletion: Data subjects may request deletion under certain conditions.
  • Objection: Users can refuse data processing for specific reasons.
  • Portability: Data subjects may request their data in a portable format.
  • Automated Decision-Making: Users can object to automated profiling that significantly affects them.

  • Regulatory Authority:
    • Nigeria Data Protection Commission (NDPC) oversees compliance.
  • Penalties:
    • Failure to comply with orders – Fine up to NGN 10,000,000 (≈ USD 12,200) or 2% of annual gross revenue.
    • Unauthorized data processing – Fine up to NGN 2,000,000 (≈ USD 2,440) or 2% of annual gross revenue.
    • Failure to report a data breach – Fine up to NGN 5,000,000 (≈ USD 6,100).
    • Severe violations – Higher penalties and potential imprisonment for up to one year.