Cowry Tech News
Policy

NDPA and GAID: Nigeria’s compliance-audit playbook is live

The Nigeria Data Protection Commission’s General Application and Implementation Directive (GAID) 2025, effective 19 September 2025, retires NDPR as the day-to-day rulebook and puts annual Compliance Audit Returns on a named calendar for Ultra-High and Extra-High controllers and processors — with licensed DPCOs in the filing path.

By Kwesi Addo · 1 Oct 2026 · 13 min

On 20 March 2025 the Nigeria Data Protection Commission (NDPC) issued the Nigeria Data Protection Act (NDP Act) 2023 General Application and Implementation Directive (GAID) 2025 — document mark NDPC/NDP ACT-GAID/01/2025. Secondary analysis published by the International Association of Privacy Professionals (IAPP) states the directive took effect on 19 September 2025. For operators who still treat “NDPR audit season” as the mental model, that date is the operational hinge: the Commission, on issuance of the GAID, ceases to apply the Nigeria Data Protection Regulation (NDPR) 2019 as the legal instrument for regulating data privacy and protection, while actions already taken under the NDPR before issuance remain valid under the Act’s transitional logic (GAID Article 3(3), reading Section 64 of the NDP Act).

This is a process explainer: instruments first, then filing mechanics, then buyer and vendor questions. It is not legal advice and not a DPCO sales pitch. Lagos and Abuja product teams, US and Ghana corridor vendors who process Nigerian personal data, and enterprise buyers writing trust questionnaires need the same map — what replaced NDPR, who files what, by when, through whom, and where the text still argues with itself.

Define the instruments

Two documents sit in one stack.

Nigeria Data Protection Act (NDP Act / NDPA) 2023 is the primary statute. Section 63 of the Act, which the GAID quotes for ease of reference, says that where another law relates to processing of personal data and conflicts with the Act, the Act prevails. The GAID itself says that if the Act and the GAID conflict, the Act wins (Article 3(2)).

GAID 2025 is the Commission’s general application and implementation directive under the Act. It is the operational playbook: registration tiers, compliance measures, Compliance Audit Returns (CAR), Data Protection Officer (DPO) duties, cookie notice rules, breach notification clocks, and schedules that include a CAR template (Schedule 2) and CAR filing fees (Schedule 10). The official PDF is published on the NDPC site.

“Nigeria privacy law” is three layers, not one slogan. NDPR was the 2019 regulation. NDPA is the statute. GAID is the live implementation layer that tells controllers and processors how the Commission expects the Act to run day to day.

What “in force” means for NDPR habits

Article 3(3) of the GAID is the clean cut: upon issuance, the Commission shall cease to apply NDPR 2019 as a legal instrument for regulating data privacy and protection. The same article protects things already done under NDPR before GAID issuance. TEMPLARS’ April 2025 client alert summarises the practical effect: NDPR-era annual audit returns filed before GAID issuance stay valid; the forward-looking rulebook is NDPA + GAID.

Internal policy decks that still cite NDPR article numbers, vendor questionnaires that ask “are you NDPR compliant?”, and board packs that treat NDPR as current law are out of date. Update the vocabulary. Ask for NDPA/GAID mapping: registration status, DPO designation, last compliance audit date, CAR filing status if in UHL or EHL, and DPCO engagement where required.

Major importance: UHL, EHL, OHL

Section 65 of the NDP Act defines a data controller or data processor of major importance (often shortened in secondary writing to DCPMI) by volume thresholds the Commission may prescribe, or by class of processing of particular value or significance to Nigeria’s economy, society, or security. GAID Article 8 expands “operating in Nigeria” to include targeting a data subject in Nigeria even when the controller or processor is not domiciled or resident in Nigeria — tying that reading to the Act’s application and accountability provisions.

Article 8(4) classifies major data processing into three levels:

  1. Ultra-High Level (UHL)
  2. Extra-High Level (EHL)
  3. Ordinary-High Level (OHL)

Schedule 7 of the GAID reproduces the Commission’s Guidance Notice on classes and fees. Illustrative examples in that Notice (not an exhaustive CTN list of every possible entity) include:

  • UHL examples: commercial banks at national or regional level; telecoms; insurance; multinationals; electricity distribution companies; oil and gas; public social media and email app developers/proprietors; communications device manufacturers; payment gateway providers; fintechs — plus organisations processing personal data of over 5,000 data subjects in six months (per the Notice’s additional volume rule).
  • EHL examples: MDAs; microfinance banks; higher institutions; hospitals providing tertiary or secondary medical services; mortgage banks — plus organisations processing over 1,000 but fewer than 5,000 data subjects in six months (per the Notice).
  • OHL examples: primary and secondary schools; corporate training providers; primary health centres; independent medical laboratories; hotels/guest houses with fewer than 50 suites; processors of sensitive personal data of more than 200 data subjects for commercial purposes — plus organisations processing over 200 but fewer than 1,000 data subjects in six months (per the Notice).

The Guidance Notice also uses factor tests (sensitivity, financial assets entrusted, cloud dependence, cross-border flows, certifications, and so on), with “any four” of listed factors sufficient for categorisation in the UHL/EHL/OHL factor paragraphs. Do not self-classify from a headline alone. Read Schedule 7 against your actual processing profile, then confirm with counsel or a licensed DPCO.

Registration vs Compliance Audit Returns

Article 9 separates registration mechanics by tier.

  • UHL or EHL: register once; file CAR annually.
  • OHL: renew registration with the Commission annually; not required to file annual CAR when renewing registration annually.
  • Significant changes to registration information: notify the Commission within 60 days.
  • The Commission is to publish the register of duly registered controllers and processors of major importance and update it at least once annually.

Article 7(c) aligns the CAR filing duty with UHL and EHL: file NDP Act Compliance Audit Returns with the Commission not later than 31 March each year.

Article 10 is where careful readers slow down. Article 10(1)–(5) require periodic, risk-based compliance audits of people, processes, and technologies for controllers and processors generally, with more frequent audit of online devices that can access personal data. Article 10(6) then says a data controller or data processor of major importance shall file CAR annually on the Schedule 2 template. Article 10(7)–(8) set timing: entities of major importance established before 12 June 2023 file by 31 March each year; those established after that date file within 15 months of establishment, then annually. Article 10(14) says, except as otherwise approved by the Commission, UHL and EHL shall file CAR through a Data Protection Compliance Organisation (DPCO) licensed under Section 33 of the NDP Act.

Secondary legal notes (TEMPLARS, Credence Law, Bloomfield) generally treat the live playbook as: UHL/EHL file annual CAR (typically via DPCO); OHL renews registration annually without CAR. Bloomfield’s mid-2025 note flags tension between Article 7/9 carve-outs and broader Article 10 wording. CTN soft hold: until NDPC publishes a clarifying notice, report both readings and ask counsel or a DPCO which filing path applies. The PDF does not cleanly unify the rule.

Calendar and money

Two clocks sit on most compliance boards.

Audit clock: Article 7(b) expects a compliance audit within 15 months of commencement of business and thereafter annually. That audit duty is broader than the CAR filing duty.

CAR clock (UHL/EHL under the Article 7/9 reading): not later than 31 March each year for pre–12 June 2023 major-importance entities; first CAR within 15 months for post–12 June 2023 establishments, then annually. TEMPLARS notes the filing deadline moved from 15 March (NDPR-era habit) to 31 March under GAID.

Late filing: Article 10(9) — failure to file CAR as and when due attracts, in addition to the stipulated filing fee, an administrative penalty of 50% of the stipulated CAR filing fee.

Fees: Article 10(10) points UHL and EHL CAR filing fees to Schedule 10 unless the Commission determines otherwise. Schedule 10 in the GAID PDF sets tiered naira amounts by data-subject bands for UHL and EHL (for example, UHL Tier A at 50,000 data subjects and above lists ₦1,000,000; EHL Tier A at 10,000 and above lists ₦250,000 — verify current Schedule 10 / portal fees before budgeting). Registration fees for UHL/EHL/OHL classes also appear in the Guidance Notice reproduced as Schedule 7 (e.g., UHL ₦250,000, EHL ₦100,000, OHL ₦10,000 in the Notice’s specific-types paragraph). Treat PDF numbers as published instruments, not live invoices — portals and amendments can move.

Article 10(12) says annual CAR filing shall run through an automated platform or portal provided by the Commission. Article 10(13) allows the Commission to issue a Compliance Audit Returns Certificate upon filing.

What Article 7 expects beyond the CAR

Filing alone is not compliance. Article 7 lists a long set of expected measures. Operators who reduce the work to “pay the DPCO and upload a PDF” often miss:

  • Semi-annual data protection reports analysing processing within six months (Article 7(e)), which secondary notes say DPCOs review in the annual audit path.
  • Schedules for monitoring, evaluation, and maintenance of data security systems (confidentiality, integrity, availability).
  • Organisation-wide sensitisation and training; personnel training within six months of commencement and at least annually thereafter.
  • Designation of a DPO for controllers/processors of major importance, with associate DPOs/privacy champions where multi-platform processing warrants it (Articles 7(i), 11–14).
  • Privacy policies published on platforms; homepage privacy and cookie notices with a real accept/decline path. The GAID treats a cookie notice parked only at the bottom of a page as lack of transparency (Article 7(l)).
  • DPIA when required under the Act or directed by the Commission.
  • Breach notification to the Commission within 72 hours of becoming aware; notify the data subject immediately where the breach may pose high risk to their privacy (Article 7(p)–(q)).
  • Updated third-party processor agreements; subject-access, rectification, and portability design that is actually usable (Article 7(r)–(u)).
  • Clear complaints process, including the right to lodge with the Commission.

Articles 11–14 add DPO publication of contact details to the Commission, organisational support duties, semi-annual internal reporting by the DPO, and Annual Credential Assessment (ACA) of designated DPOs — the Commission maintains a database of certified DPOs and assesses credentials so designation is not a paper title.

Buyer and vendor checklist (process + trust)

Kwesi process spine; Arjun product/trust depth for implementation questions.

  1. Name the instrument set. Ask vendors: NDPA + GAID mapped, or still NDPR language only?
  2. Self-classification. UHL, EHL, OHL, or not of major importance under Schedule 7 / Guidance Notice factors — with a written rationale.
  3. Registration evidence. Proof of NDPC registration (and OHL renewal cadence if applicable). Check the public register when updated.
  4. CAR path (if UHL/EHL). Last CAR filing date, DPCO name and licence status, portal confirmation, any CAR certificate.
  5. Audit vs filing. Date of last full compliance audit (Article 7(b) / Article 10 risk-based audit) separate from CAR upload day.
  6. Semi-annual internal reports. Existence and freshness of the six-month processing analyses Article 7(e) expects.
  7. DPO. Named DPO, published contacts, Commission notification, ACA status if relevant.
  8. Cookies and notices. Homepage notice that can be accepted or declined without living only in a bottom strip.
  9. Breach clocks. Documented 72-hour Commission path and high-risk subject notification path.
  10. Processors and cloud. Third-party agreements updated for NDPA; inventory of online devices and cloud services that can access personal data (Article 10(5) frequency language).
  11. Cross-border. Transfer tools and accountability for processing Nigerian personal data from outside Nigeria (Article 8 targeting / Act application).
  12. Fee and penalty awareness. Schedule 10 bands and 50% late-filing add-on — budget lines, not folklore.

Arjun trust depth (product / AppSec implementation): treat CAR filing as necessary and incomplete. A stamped return does not prove the controls that matter to buyers.

  1. Control mapping. Ask how each audit finding maps to people, process, and technology risk points — named owners, not a PDF appendix nobody maintains.
  2. Online-device / cloud frequency. Article 10(5)-style inventory of online devices and cloud services that can touch personal data: what is the scheduled audit frequency, and who signs that the inventory is current?
  3. DPIA triggers. Written criteria for when a data-protection impact assessment starts (new product, new processor, new cross-border path) — not “we do DPIAs when counsel remembers.”
  4. SNAG vs Commission complaints. How Standard Notice to Address Grievance routes interact with a data subject’s right to lodge with the Commission; escalation clocks; who owns the ticket when both paths fire.
  5. AuthN/AuthZ for admin surfaces. For products that store Nigerian personal data, demand SSO, MFA, and role separation on admin consoles — NDPA filing does not replace basic access control.
  6. Logging and breach evidence. Can you produce access logs and retention policy that would support a 72-hour Commission notification narrative without reconstructing from Slack?

Buyers need named controls and dated evidence. Scare copy about “NDPA fines” without those artifacts is noise.

Africa-positive evidence and material critique

Evidence of seriousness. Nigeria now has a statute-plus-directive stack with named tiers, a March calendar, DPCO intermediation for UHL/EHL CAR, a public-register ambition, cookie rules that reject bottom-of-page theatre, and explicit retirement of NDPR as the forward instrument. The Commission put filing mechanics on paper after the framework law.

Material critique. Article 10’s major-importance CAR language sits uneasily beside Article 7(c) and Article 9’s OHL exemption from annual CAR; secondary practitioners already flag the gap. Fee schedules live in Schedules buyers must keep current. “Operating in Nigeria” via targeting widens accountability and hits offshore SaaS teams that never filed under NDPR. Cookie UX rules are specific enough that moving a banner without real choice still fails the transparency test. Those seams stay in the copy.

Boundaries

This is not Chioma’s NIBSS or Remita product story. It is not Cole’s cloud capacity brief. It is not Arjun’s standalone AppSec checklist — though trust depth belongs with him when the question turns from “what does the instrument say?” to “how do we prove controls?” Capital desk owns funding frames. Lone Cowry Website owns WP theme and deploy after Benny’s gate.

What we still do not know

  • A single NDPC FAQ resolving Article 10 vs Article 7/9 CAR scope for every OHL and non–major-importance entity.
  • Live portal screenshots and current fee tables if Schedule 10 has been amended after the March 2025 PDF.
  • Population completeness of the published major-importance register at any given week.
  • Enforcement statistics for the 50% late-filing penalty under GAID (CTN will not invent them).

Outlook

Near-term signals: portal filing into the next 31 March cycle; clarifying guidance on Article 10; DPCO capacity and pricing for UHL/EHL fintech and payments firms; how US and Ghana corridor vendors that target Nigerian users update contracts and cookie UX. The story worth tracking is narrower than “Nigeria got a privacy law.” GAID turned NDPA into a filing and audit calendar with named tiers, and that calendar still fights itself in places operators have to resolve with primary text and licensed help.

Related reading: For a separate buyer-literacy checklist on a CISA KEV affecting Cisco Catalyst SD-WAN Manager (inventory / fixed release / pre-patch triage — not an NDPA filing story), see CISA KEV: Cisco SD-WAN Manager CVE-2026-76504.

Sources and method

No invented metrics, enforcement counts, or partner endorsements. Soft hold stands on CAR-scope grey areas until NDPC clarifies.