Nigeria · Compliance
Nigeria Data Protection Act 2023 compliance in Nigeria
Achieve Nigeria Data Protection Act 2023 compliance with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- Compliance, end to end
- Lagos office team
- Effivity software included
- Academy training included
Who asks for Nigeria Data Protection Act 2023 in Nigeria
Clients include
Nigeria Data Protection Act 2023 compliance in Nigeria at a glance
Nigeria Data Protection Act, 2023 (Act No. 37) is the instrument itself: it applies to the organisations within its scope, and buyers and partners in Nigeria ask for evidence that you meet it.
Since 12 June 2023, the Nigeria Data Protection Act has put one independent regulator, the Nigeria Data Protection Commission, in charge of how organisations handle personal data. The Act reaches controllers and processors operating in Nigeria and outside organisations processing the data of people in Nigeria, and it covers principles, lawful bases, data subject rights, security, breach notification and transfers abroad. The Commission's 2025 implementation directive adds the working detail: classification and registration of major data processors, annual compliance audit returns, Data Protection Officer duties and expectations for artificial intelligence and other emerging technologies. There is no NDPA certificate; compliance is shown through evidence, and ISO/IEC 27701 or ISO/IEC 27001 certification by an accredited body is an optional supplement. Sterling's Lagos office runs data mapping, notices, impact assessments, processor agreements and Data Protection Officer support, using Effivity to keep evidence current.
Who needs Nigeria Data Protection Act 2023 in Nigeria, and what happens without it
These are the organisations in Nigeria that most often need to show Nigeria Data Protection Act 2023.
- Any organisation processing personal data in Nigeria or about people in NigeriaThe Act applies to controllers and processors domiciled, resident or operating in Nigeria, to processing that occurs in Nigeria, and to outside organisations processing data of people in Nigeria.
- Data controllers and processors of major importanceThey register with the Commission, designate a Data Protection Officer and file annual compliance audit returns under the 2025 directive.
- Banks, fintechs and payment firmsCustomer data volumes are high, and the Act's security, breach-notification and transfer rules sit beside the Central Bank's frameworks.
- BPO and IT-services firms handling data for overseas clientsProcessors must follow the Act's duties and sign written agreements with controllers, whatever the client's home law says.
- Organisations using artificial intelligence, cloud services or offshore hostingThe directive sets expectations for emerging technologies and the Act sets conditions for sending personal data out of Nigeria.
Not sure which of these applies to you?Answer a short set of questions and your readiness report arrives by e-mail.
Take the free readiness checkNigeria Data Protection Act 2023 requirements in Nigeria
Strip away the vocabulary and Nigeria's Data Protection Act requires a business to comply in six areas of personal data handling.
In Nigeria these six sit alongside the local laws and regulations listed under drivers below; one system can evidence both. The detail is on the global hub: Nigeria Data Protection Act 2023 explained →
How to achieve Nigeria Data Protection Act 2023 compliance in Nigeria
One team from the Lagos office carries the work from scoping to sign-off. Clients across Nigeria are served from Sterling's Lagos office, on-site where the work needs it and remotely otherwise.
- Discovery call and scopeEntities, locations, regulators and target date, agreed before any proposal.
- Gap assessment against Nigeria Data Protection Act 2023 and the Nigerian requirements that apply to youControls you already run for your regulators and customers are reused, not rebuilt.
- Your system built with your team in EffivityRisks, controls, evidence, incidents and reviews in one live system the auditor can see.
- Internal audit, management review and corrective actionsYour internal auditors trained by Sterling; the evidence proven before any external review.
- Reviews by regulators, customers and auditorsSterling supports the reviews your regulators, customers and auditors run.
- End to end, from one team
- Effivity ISO & GRC software
- Preferential Sterling Academy access, with complimentary awareness training for your people
- Internal auditor training for your audit team, as applicable to your standard
- Vulnerability assessment on ISMS engagements
The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements.Sterling does not certify. Certification decisions stay with independent bodies.
How long does Nigeria Data Protection Act 2023 compliance take in Nigeria?
There is no standard duration: it depends on your scope and on how much of the system already runs. In Nigeria these are the factors that set the timeline.
- Number of processing activities, systems and processors to map
- Classification as a controller or processor of major importance and the filings that follow
- Designation and training of a Data Protection Officer
- Cross-border transfers and cloud or offshore hosting to review
Sterling agrees a dated plan with you on the discovery call, once the scope is known.
How much does Nigeria Data Protection Act 2023 compliance cost in Nigeria?
The cost has two parts: the consulting work to build and prove the system, and any external assessor’s fees, which are quoted separately. In Nigeria these factors move both.
- Number of legal entities, business units and data subjects in scope
- Volume and sensitivity of data, including health, biometric and children's data
- Review and renegotiation of processor and transfer agreements
- Security remediation and fees of any licensed compliance organisation, quoted separately
Sterling gives one customised, all-inclusive proposal after the discovery call, never before the scope is agreed.
Nigeria Data Protection Act 2023 consultants and assessors in Nigeria
Two different organisations are involved. A consultant helps you build the system and prove it works; your regulators, customers and auditors then audits or assesses it and decides. Keeping the two separate is what makes the result credible to buyers and regulators.
- Check that the body’s accreditation or approval covers Nigeria Data Protection Act 2023 and your sector, and that its certificates can be verified online.
- Ask the consultant how the local requirements in Nigeria are mapped into the same system, so nothing runs twice.
- Ask for client references in your sector; Sterling’s client letters are available on request.
- Agree who owns the evidence and the tool after the engagement; with Sterling the system stays yours, in Effivity.
Laws and regulations that drive Nigeria Data Protection Act 2023 in Nigeria (4)
| Instrument | How it treats the standard |
|---|---|
| Nigeria Data Protection Act, 2023 (Act No. 37) | The instrument itself Principles, lawful bases, rights of data subjects, security, breach notification, cross-border transfer and registration of controllers and processors of major importance, regulated by the Nigeria Data Protection Commission. |
| NDP Act General Application and Implementation Directive (NDP Act-GAID) 2025 | Regulator directive General compliance measures, classification and registration of major data processors, annual compliance audit returns, Data Protection Officer duties, emerging technologies and cross-border transfer, with schedules and templates. |
| Nigeria Data Protection Commission — compliance organisations and registers | Regulator scheme The Commission licenses Data Protection Compliance Organisations to train, audit and advise, publishes a register of controllers and processors of major importance and takes breach reports. |
| Constitution of the Federal Republic of Nigeria, 1999 — section 37 | Constitutional footing The privacy of citizens, their homes, correspondence and communications is guaranteed and protected, and the Act names the Constitution as the source of the rights it safeguards. |
Accreditation, audit language and remote audits in Nigeria
Compliance, not certification: the Act creates no certificate of conformity. Evidence is your own records, privacy notices, processor agreements, impact assessments, breach register and any filings the Commission requires; the Commission may issue a certificate on receipt of annual audit returns, which records filing and is not an assessment of your practices. ISO/IEC 27701 or ISO/IEC 27001 certification by an accredited body is an optional way to evidence the systems behind your answers. Edition and transition details: Nigeria Data Protection Act 2023 hub →
Audit language
English is the usual audit and document language; agree it with the certification body at application, and say early if interviews will run in another language.
Remote and on-site
Data mapping workshops, notice reviews and processor-agreement work can be done on-site or remotely; the Act does not prescribe an external assessment for every organisation, and filings are made through the Commission's portal.
Nigeria Data Protection Act 2023 in Nigeria: questions clients ask
Is there a Nigeria Data Protection Act certificate?
No. The Act creates no certificate of conformity. You show compliance through records, notices, impact assessments, processor agreements and a breach register, plus any filings the Commission requires. Under the 2025 directive the Commission may issue a certificate when audit returns are filed, which records the filing rather than assessing your practices. Confirm your own position with counsel or the Commission.
Who must register with the Commission as a data controller or processor of major importance?
Controllers and processors of major importance, a class defined by the number of data subjects the Commission prescribes or by processing of particular value to the economy, society or security. The 2025 directive sorts them into Ultra-High, Extra-High and Ordinary-High levels. Whether you qualify, and at which level, is for the Commission to determine, so check its current guidance.
Does the Act apply to a company based outside Nigeria?
It can. The Act applies where a controller or processor outside Nigeria processes the personal data of a data subject in Nigeria, and the 2025 directive says operating in Nigeria includes targeting people there. Domicile alone therefore does not settle the question. Ask counsel how the Act and your home-country law apply together before you finalise contracts.
How quickly must a personal data breach be reported in Nigeria?
A controller must notify the Commission within 72 hours of becoming aware of a breach likely to result in a risk to individuals, and must tell affected people immediately where the risk is high. A processor must tell the controller that engaged it. Keep a breach register, and take advice from counsel or the Commission on how the duty applies to an incident.
More on Nigeria Data Protection Act 2023 for Nigerian organisations
Other standards Nigerian businesses ask Sterling for
Organisations in Nigeria often combine Nigeria Data Protection Act 2023 with one of these, under one management system where the scopes allow.
Start with a free discovery call from the Lagos office
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Nigeria Data Protection Act, 2023 (Act No. 37) — ndpc.gov.ng (accessed 11 Oct 2026)
- NDP Act General Application and Implementation Directive (NDP Act-GAID) 2025 — ndpc.gov.ng (accessed 11 Oct 2026)
- Nigeria Data Protection Commission — compliance organisations and registers — ndpc.gov.ng (accessed 11 Oct 2026)
- Constitution of the Federal Republic of Nigeria, 1999 — section 37 — ndpc.gov.ng (accessed 11 Oct 2026)
Talk to a consultant
Plan your certification with the Lagos team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
southafrica@sterling-grc.com+1 201 263 4443 (global headquarters) · the Lagos office replies by e-mail within one working day
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice