NDPA 2023 · Nigeria's personal data law
Nigeria Data Protection Act compliance for personal data handled the way the Commission expects.
Turn the Nigeria Data Protection Act 2023 into daily practice, with the proof ready for your annual audit return, a customer's due diligence or the Nigeria Data Protection Commission. Sterling's expert and experienced consultants build the programme with your legal, technology and operations teams. We help our clients put it into practice and prove it.
- Fixed scope, one proposal: consulting, Effivity software, Sterling Academy access and internal auditor training, as applicable to your standard, in one proposal
- A team of expert and experienced data protection consultants, advising on privacy and security programmes across sectors and countries since 2003
- The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements. No certificate exists under the Act; Sterling prepares the programme and the evidence, and the Commission regulates
8,100+ client engagements in 60+ countries.
Why organisations choose Sterling
What it is
What is the Nigeria Data Protection Act and what is it used for?
The Nigeria Data Protection Act, 2023 is the country's primary law on personal data. It created the Nigeria Data Protection Commission, the country's Data Protection Authority, to oversee its implementation. It governs how data controllers and processors collect, use, share and transfer information about identifiable people, and gives those people enforceable rights.
In practice it asks a business for a lawful reason for each use of personal data, respect for the people concerned, and the ability to show both. Organisations the Commission classes as of major importance also register with it, and many file an annual compliance audit return. Breaches can bring administrative and criminal sanctions and civil claims. There is no NDPA certificate; compliance is operated and demonstrated year after year.
Current text. The Nigeria Data Protection Act, 2023 was signed into law on 12 June 2023. On 20 March 2025 the Commission unveiled the NDP Act General Application and Implementation Directive (GAID), which sets out the technical and organisational measures it expects on principles, lawful basis, the compliance audit, data subject rights and emerging technologies, and introduces the Data Subjects' Standard Notice to Address Grievance (SNAG). Check the Commission's website for its latest directives before relying on any summary.
Who it is for
Who needs to comply with the Nigeria Data Protection Act?
According to the Commission, the Act reaches organisations domiciled, resident or operating in Nigeria, processing that takes place in Nigeria, and certain processing of Nigerian data subjects' personal data by organisations elsewhere. Organisations usually reach Sterling from one of four directions:
- A customer or partner asks for evidence. A bank, multinational buyer or platform wants proof of NDPA compliance in its onboarding questionnaire, backed by records rather than assurances.
- A tender or licence application asks the question. Know your registration status and last audit return before the bid is due.
- The Commission's calendar applies to you. Registration as an organisation of major importance, or the annual return before 31 March, needs a programme behind the filing.
- A group company or foreign parent sets the rules. A foreign group runs one privacy programme and needs its Nigerian operation mapped to local law.
Requirements
What are the main Nigeria Data Protection Act requirements?
The list below follows the requirement areas the Commission itself describes in its published FAQs and its announcement of the GAID, in plain language and at headline level. It is a map, not a legal opinion; your legal advisers confirm interpretation where it matters.
- Scope and roles: establish where the Act reaches your processing and whether you act as controller, processor or both.
- Data protection principles: handle personal data in line with the principles the Act sets and be able to demonstrate how each is met.
- Lawful basis of processing: identify and record a lawful basis for every processing activity before it starts, including consent where that is the basis relied on.
- Data subject rights: honour the rights the Act grants and handle requests and grievances, including those raised through the Commission's SNAG process.
- Technical and organisational measures: put in place and maintain the measures the GAID expects to protect personal data across systems, people and suppliers.
- Registration with the Commission: register where the Commission classes you as a controller or processor of major importance, and keep it current.
- Compliance audit returns: where they apply to you, file the annual return before 31 March through a licensed Data Protection Compliance Organisation.
- Cross-border transfers: move personal data out of Nigeria only on a recognised basis, such as an adequacy decision of the Commission, an approved transfer instrument or another basis the Act allows.
What does useful NDPA evidence look like?
A processing inventory with the lawful basis for each activity, notices that match practice, a dated request log, supplier agreements covering data protection, records of security measures, a transfer map, registration records and the working papers behind your last return. They sit in Effivity from the first workshop, so your DPCO or a client auditor meets current records.
Compliance process
How do you achieve Nigeria Data Protection Act compliance?
Compliance is built, then demonstrated each year. Sterling helps you design and run the programme; the Commission regulates, and a licensed DPCO you appoint handles the audit return.
- 01Confirm how the Act applies to you.Map entities, systems and data subjects, your role per activity, and whether registration and returns apply.
- 02Gap analysis: compare current practice with the Act and the GAID.Inventory processing, test notices, contracts, controls and rights handling, and agree actions and owners.
- 03Implement the programme and record it as you go.Record lawful bases, update notices and supplier terms, apply security and retention controls and train your people.
- 04Audit internally and prepare the return file.An internal audit and a management review test what operates; we raise findings first, close them with evidence and assemble the file your DPCO will examine.
- 05Register, file and keep the programme live.Complete registration where it applies, file the annual audit return through your licensed DPCO before 31 March, and repeat the cycle as systems, suppliers and guidance change.
Check the route before you sign. Ask any firm offering to file your audit return for proof of its current DPCO licence and confirm it with the Commission directly. Be wary of "NDPA certificate" offers: the Act issues no certificate, and a document that claims to be one proves nothing to the Commission or to a client auditor. The certification buyer's checklist
Cost
How much does Nigeria Data Protection Act compliance cost?
Cost follows the volume of personal data, the systems and suppliers that touch it and what already exists. We quote after scoping, and nothing is added later.
| Cost component | What affects it |
|---|---|
| Consulting and implementation | Activities, systems and suppliers to map, entities in scope, and how much work your team takes on (Design™ or Drive™) |
| DPCO and Commission charges | The licensed DPCO's fee for your audit return and any charges payable to the Commission, outside Sterling's fee and shown separately |
| Internal resources and legal | Owners' time, IT changes, training hours and any legal review |
| Software and learning | Included in a Sterling engagement: Effivity for the programme and Sterling Academy access for your people, with users, courses and access period confirmed in the proposal |
| Continued support | Internal audits, annual return preparation and guidance updates under Sustain™ |
What moves the price
- Data volume and number of data subjects
- Entities and branches in scope
- Suppliers and transfers abroad
- Any existing ISO/IEC 27001 or GDPR programme
- Your filing or contract date
What a Sterling proposal always shows
- Deliverables, responsibilities, assumptions and exclusions, in writing
- Third-party charges, such as the DPCO's fee, listed separately
- Effivity, training and Academy access itemised at no additional cost
- Payment milestones tied to deliverables, not to the calendar
- One all-inclusive proposal. No surprises, ever
Timeline
How long does Nigeria Data Protection Act compliance take?
As an estimate, a first programme takes three to six months: shorter where a data inventory and security system exist, longer where many branches and suppliers must be mapped. Decisions on lawful bases, retention and transfers set the pace more than documents do.
| Phase | What determines the pace |
|---|---|
| Applicability and gap analysis | Access to system owners, contracts and existing records, and how quickly the processing inventory is completed |
| Build and implementation | Lawful-basis and retention decisions, supplier negotiations, IT changes and training |
| Evidence and internal audit | Controls running long enough to produce records, followed by internal audit and management review |
| Registration and return | The Commission's registration process and the timing of your DPCO's review ahead of the 31 March filing date |
If a return is due soon, say so on the first call; we will tell you what can be evidenced in time.
Your engagement
What your NDPA engagement includes
Sterling does not certify, attest or validate NDPA compliance. Audit returns are filed through the licensed Data Protection Compliance Organisation (DPCO) you appoint; we prepare the programme and the evidence and work alongside your legal advisers and that DPCO. Your engagement follows the Sterling OS™ phases: choose Design™, where we guide and your people build, or Drive™, where we manage the build. Once the programme runs, Sustain™ keeps it current each year, and Automate™ is Effivity.
Applicability review, gap analysis and plan
Roles, registration and return duties confirmed, with owners and dates.
Policies, notices and procedures
Written for your actual processing, with your process owners.
Effivity ISO & GRC software
Included with the engagement at no additional cost.
Training for everyone
Internal auditor training for your audit team, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.
Internal audit and management review
Findings closed with evidence before the return is prepared.
Return readiness and support
An evidence file for your DPCO, and support through registration and filing.
Regulatory decisions remain with the Nigeria Data Protection Commission.
Often combined with
Standards organisations pair with Nigeria Data Protection Act
- ADGM Data Protection Regulations 2021ADGM data protection compliance for entities under the 2021 Regulations: lawful bases, DPO, impact assessments, 72-hour breach notice and transfers, all-inclusive proposal.
- APEC CBPRAPEC CBPR certification and requirements explained: Global CBPR and PRP, Accountability Agent review, annual renewal and how Sterling prepares your team.
- APPI (Japan)APPI compliance for Japan's Act on the Protection of Personal Information: the requirements, PPC breach reporting, cross-border rules and an all-inclusive programme.
- Bahrain PDPLBahrain PDPL compliance and requirements explained: consent, notification to the Authority, transfers abroad, 72-hour breach reporting, rights, cost and timing.
- CCPA / CPRACCPA compliance and requirements under the CPRA: notices, consumer rights, opt-outs, risk assessments, cybersecurity audits and ADMT, in an all-inclusive programme.
- Cyber and Data Protection Act (Zimbabwe)Zimbabwe's Cyber and Data Protection Act [Chapter 12:07]: POTRAZ licensing, lawful processing, security and transfers, built into a programme.
Effivity · data protection software, included in every engagement
How Effivity helps you fulfil, automate and simplify the requirements of the Nigeria Data Protection Act 2023.
Every Sterling NDPA engagement includes Effivity, the ISO and GRC automation platform built by the Sterling group and used in 50+ countries. Your consultant sets up the privacy workspace within the agreed scope, so the processing inventory, lawful bases, notices, supplier agreements, rights requests, incidents, transfers, audits and management review sit in one place and the evidence for each year's return builds itself from daily work. Sterling consulting clients get their Effivity subscription included with the engagement, at no additional cost.
Entities, systems and controller or processor roles
Each entity, system and processing activity recorded with its role, owner and data subjects, so the answer to "does the Act reach this?" is on file rather than in someone's memory.
Processing inventory and retention
Purpose, categories of data, retention period and security for every activity, reviewed on a schedule and updated when a system or process changes.
Lawful-basis and consent records
The basis chosen for each activity with its reasoning, and consent records with wording and dates where consent is relied on.
Requests and grievances
Every request or complaint logged with identity checks, deadlines, responses and outcome, including matters raised through the Commission.
Security controls and incidents
Risks, controls and their owners, plus an incident register with investigation, decisions and follow-up actions recorded as they happen.
Suppliers and transfers abroad
A processor register with agreements attached, and each transfer out of Nigeria recorded with its basis and review date.
Internal audit, review and the return file
Audit programmes, findings and corrective actions, management review decisions and the evidence file your DPCO examines each year.
Your own forms, workflows and reports
Workflows and reports shaped to your organisation without code, with other laws and customer requirements tracked alongside the NDPA.
What this means at the audit return
The DPCO reviewing your return, and any client auditor, will ask for the processing inventory, the rights-request log, the supplier agreements, the incident register and the training records. In Effivity each is a screen with dates, owners and evidence attached, ready well before the 31 March filing date. Sustain™ then runs in the same workspace, so next year's return starts from a live record instead of a blank folder.
In your engagement
- Subscription included with the engagement, at no additional cost
- Configured by your Sterling consultant within the agreed scope
- Your documents, records and registers migrated, not retyped
- Admin and user training for your team
- Modules for ISMS, PIMS, QMS and more when you integrate other standards
Sterling Academy · data protection e-learning
Train everyone who handles personal data, not just the privacy lead.
Sterling Academy delivers e-learning for the whole workforce and for the people who run the programme: video lessons with practice checkpoints, a final exam and a numbered Certificate of Completion for each learner, verifiable online. Sterling consulting clients benefit from preferential Sterling Academy course access and special pricing through their Sterling consultant, including complimentary awareness training for their people as part of the engagement.
- Data protection awareness for every employee, with training records ready for the audit return
- Deeper learning for the data protection lead, system owners and customer-facing teams
- Internal auditor training for the people who will audit the programme, as applicable to your standard, as part of the engagement
- Progress by department, and new joiners trained as they arrive
Where we work
Where Sterling delivers Nigeria Data Protection Act
Keep exploring
Explore more about Nigeria Data Protection Act
NDPA resources
Services for Nigeria Data Protection Act
Why Sterling
Why choose Sterling for Nigeria Data Protection Act compliance?
Organisations handling Nigerian personal data often also answer to the GDPR, a group policy or ISO/IEC 27001. Sterling builds one programme that meets the NDPA on its own terms and shares records with those obligations.
Privacy programmes in 60+ countries since 2003
Programmes for banks, BPOs, technology, healthcare and public bodies, with one engagement team accountable.
All-inclusive proposal
Consulting, Effivity, training and Academy access in one proposal, with Commission and DPCO charges shown separately. No surprises, ever.
Records that run themselves
Controls, training and software tied to daily work, so each year's return is assembled from records that already exist.
Expert and experienced consultants
Consultants who have built data protection and information security programmes across sectors and countries, and who work alongside your legal advisers rather than in place of them.
The Sterling Promise
What our Nigeria Data Protection Act compliance guarantee means
We stay with you until your agreed NDPA compliance outcome is achieved, supporting implementation, return preparation and the closure of findings raised by your DPCO or a client auditor. Included software and employee learning turn the investment into capability your organisation keeps.
The engagement identifies the law, scope, outcome and responsibilities. Your organisation supplies accurate information and puts the agreed controls into use. The Nigeria Data Protection Commission regulates and enforces the Act, and the licensed DPCO you appoint is responsible for its work on your return. Our commitment concerns the agreed compliance support, not the outcome of any regulatory action or tender.
FAQs
Frequently asked questions about the Nigeria Data Protection Act
Is there an NDPA certification?
No. The Act does not provide for a certificate of compliance. What it provides is registration for organisations of major importance and, for many of them, an annual compliance audit return filed through a licensed DPCO. Where customers want a certificate, ISO/IEC 27701 or ISO/IEC 27001 can be certified by an accredited body alongside it.
Does the Nigeria Data Protection Act apply to companies outside Nigeria?
It can. The Commission's guidance says the Act also covers certain processing of Nigerian data subjects' personal data by organisations based elsewhere. Whether it applies to your activities is a question for your legal advisers; we map the processing so they can answer it on facts.
If we already comply with the GDPR, are we compliant with the NDPA?
Not automatically. A GDPR programme gives you a strong base, including an inventory, notices and supplier terms, but the NDPA has its own registration, audit return, transfer and grievance arrangements. We reuse what already works and add what the Nigerian law requires.
Who can file our NDPA compliance audit return?
The Commission states that audit returns are filed through a Licensed Data Protection Compliance Organisation (DPCO), which your organisation appoints directly. Sterling prepares the programme and the evidence file the DPCO reviews.
Does Sterling give legal advice on the NDPA?
No. Sterling designs and builds the compliance programme and keeps its evidence. Interpretation of the Act and the Commission's directives for your circumstances stays with your legal advisers, and we work alongside them throughout.
Keep exploring
More on Nigeria Data Protection Act and related standards
More in Privacy & data protection
Talk to a consultant
Plan your Nigeria Data Protection Act compliance with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice