Nigeria NDPA Compliance with ConsentX

What is the Nigeria Data Protection Act?

The Nigeria Data Protection Act 2023 establishes Nigeria's modern statutory framework for personal-data protection.

Its objectives include:

• Protecting fundamental rights and freedoms of data subjects
• Regulating personal-data processing
• Promoting secure and privacy-respecting data-processing practices
• Ensuring fair, lawful and accountable processing
• Providing rights and remedies to data subjects
• Establishing an independent regulatory commission
• Supporting Nigeria's digital economy and international participation

The NDPC was established under the Act to supervise and regulate data protection and privacy in Nigeria.

The NDPC's current materials confirm that the NDPA applies broadly to organisations processing personal data connected with Nigeria and provides rights including access, rectification, objection, restriction, portability, erasure and rights concerning automated decision-making.

What is personal data under the NDPA?

The NDPA regulates the processing of personal data relating to natural persons.

Personal data can include information such as:

• Name
• Email address
• Telephone number
• Residential address
• Identification information
• Employee information
• Customer information
• Account information
• Location information
• Online identifiers
• IP addresses where they relate to an identifiable individual
• Device information
• Financial information
• Authentication information
• Behavioural information
• Marketing profiles
• Health information
• Biometric information

The exact treatment of a particular data element depends on whether it falls within the statutory definition of personal data and the context in which it is processed.

What is data processing?

The NDPA defines processing broadly.

Processing can include:

• Collection
• Recording
• Organisation
• Structuring
• Storage
• Adaptation
• Alteration
• Retrieval
• Consultation
• Use
• Disclosure
• Transmission
• Dissemination
• Combination
• Restriction
• Erasure
• Destruction

The NDPC confirms that the definition covers processing whether or not it is carried out through automated means.

Key NDPA data protection principles

Organisations processing personal data should operate according to the core principles established by the NDPA.

Lawfulness, fairness and transparency. Personal data should be processed lawfully, fairly and transparently.

Purpose limitation. Personal data should be collected and used for specified, explicit and legitimate purposes.

Data minimisation. Organisations should avoid collecting personal data that is unnecessary for the relevant purpose.

Accuracy. Personal data should be accurate and kept up to date where necessary.

Storage limitation. Personal data should not be retained longer than necessary for the applicable purpose or legal obligation.

Integrity and confidentiality. Appropriate security measures should protect personal data against unauthorised access, loss, destruction or other unlawful processing.

Accountability. Organisations should be able to demonstrate compliance with applicable data-protection requirements.

The NDPC's 2025 GAID also incorporates assessments of data-protection principles, lawful bases, DPIAs, legitimate interests, data-subject rights, security, international transfers and breach notification into its compliance framework.

Does the NDPA require consent?

Not for every processing activity.

Consent is an important lawful basis under the NDPA, but organisations should first determine which lawful basis applies to the processing activity.

Depending on the circumstances, processing may be supported by grounds such as:

• Consent
• Contractual necessity
• Legal obligation
• Protection of vital interests
• Public interest or exercise of official authority
• Legitimate interests, subject to applicable requirements

The NDPC's current materials specifically recognise consent as an important component of data protection while also recognising lawful processing in circumstances where consent is not the applicable basis.

What makes consent valid under the NDPA?

Where consent is relied upon, organisations should ensure that it is:

• Freely given
• Specific
• Informed
• Unambiguous
• Capable of being demonstrated
• Not unnecessarily bundled with unrelated processing

Consent should involve a meaningful choice for the data subject.

Organisations should avoid:

• Pre-ticked consent boxes
• Hidden consent
• Vague purposes
• Bundled consent
• Forced consent where another lawful basis should apply
• Interfaces designed to discourage refusal
• Continuing consent-based processing after withdrawal

A properly designed consent-management platform can help operationalise these requirements.

Consent withdrawal

Where consent is the applicable legal basis, organisations should provide an accessible mechanism for withdrawing consent.

A consent-management system should allow organisations to:

• Record consent
• Record the relevant purpose
• Record when consent was provided
• Record the method through which consent was obtained
• Track consent changes
• Record withdrawals
• Apply updated preferences
• Maintain evidence for accountability

ConsentX can provide the technical infrastructure for these workflows.

Sensitive personal data

The NDPA provides additional protections for certain categories of personal data.

Organisations handling sensitive information should apply appropriate safeguards and carefully assess:

• The nature of the data
• The processing purpose
• The lawful basis
• Security requirements
• Access controls
• Retention
• Disclosure
• International transfers
• Data-subject rights

Sensitive-data processing should receive additional governance attention because the potential impact of misuse or compromise can be significant.

Privacy notices under the NDPA

Transparency is a core requirement of the NDPA.

A privacy notice should explain relevant information about the processing activity, including where applicable:

• Identity of the controller
• Contact details
• Purposes of processing
• Categories of personal data
• Lawful basis
• Recipients
• International transfers
• Retention
• Data-subject rights
• Complaint mechanisms
• Automated decision-making where applicable

Privacy notices should be presented at appropriate points in the user journey.

A cookie banner should not be treated as a substitute for a comprehensive privacy notice.

Cookies and tracking technologies under the NDPA

Cookies and online tracking technologies should be assessed based on the personal-data processing they perform.

Organisations should determine:

• What data is collected
• Whether it relates to an identifiable person
• Why the technology is used
• Which third parties receive information
• What lawful basis applies
• Whether consent is required
• Whether information leaves Nigeria
• How long the information is retained

Examples include:

• Analytics cookies
• Advertising pixels
• Social-media trackers
• Session-recording tools
• Marketing tags
• Personalisation tools
• Conversion trackers
• Embedded third-party services

Where consent is the appropriate lawful basis, ConsentX can help collect and enforce that consent before applicable trackers execute.

Data subject rights under the NDPA

The NDPC identifies a range of rights under Sections 34 to 38 of the Act.

These include:

• Right to be informed
• Right of access
• Right to rectification
• Right to object
• Right to restrict processing
• Right to data portability
• Right to erasure
• Right to complain to the supervisory authority
• Rights concerning automated decision-making

Organisations should have operational procedures for receiving, verifying, assessing and responding to these requests.

Right of access

Data subjects can request access to personal data held about them and information concerning its processing.

The NDPC itself provides a Data Subject Access Request form and states that it aims to respond promptly and, in any event, within 30 days of receiving the request or required additional information.

Organisations should therefore implement workflows that:

• Receive the request
• Verify identity where necessary
• Determine the scope
• Search relevant systems
• Review information
• Apply applicable exemptions
• Prepare the response
• Record the outcome

Right to rectification

Data subjects may have the right to request correction of inaccurate or incomplete personal data.

Organisations should maintain procedures to:

• Identify inaccurate information
• Verify correction requests
• Update relevant systems
• Synchronise information with processors where appropriate
• Document the change

Right to erasure

In applicable circumstances, data subjects can request deletion or erasure of personal data.

Organisations should maintain processes for identifying:

• What information should be deleted
• Whether retention is legally required
• Which systems contain the information
• Which processors hold copies
• Whether backups require special treatment

Erasure should therefore be incorporated into broader data-lifecycle governance.

Right to data portability

The NDPC identifies data portability as one of the rights available to data subjects under the NDPA.

Organisations should consider how they can:

• Identify portable information
• Authenticate the requester
• Extract relevant data
• Produce data in an appropriate structured format
• Securely transfer the information where required

Right to object and restrict processing

Data subjects may have rights to object to or restrict certain forms of processing.

Organisations should maintain mechanisms for:

• Receiving objections
• Assessing the legal basis
• Restricting processing where required
• Communicating outcomes
• Recording the decision

Automated decision-making

The NDPC identifies a data-subject right relating to automated decision-making.

This is increasingly relevant for organisations using:

• Artificial intelligence
• Automated profiling
• Credit scoring
• Recruitment systems
• Fraud detection
• Personalisation
• Recommendation engines
• Automated eligibility decisions

Organisations using automated decision systems should assess transparency, lawful basis, data-subject rights, fairness and risk.

Data Protection Impact Assessment (DPIA)

The NDPA compliance framework includes Data Protection Impact Assessments where applicable.

The 2025 GAID expressly includes assessment of the need for a DPIA as part of the compliance framework.

A DPIA can help organisations evaluate processing that may create significant privacy risks.

A DPIA may examine:

• Processing purpose
• Categories of data
• Categories of data subjects
• Technology involved
• Potential privacy risks
• Security controls
• Mitigation measures
• Residual risks
• Data-subject rights

Organisations should determine whether a DPIA is required based on the nature and risk of the processing rather than treating it as a universal requirement for every activity.

Legitimate Interest Assessment

The NDPC's 2025 GAID expressly refers to Legitimate Interest Assessments (LIA) where applicable.

An LIA can help an organisation assess whether legitimate interest is an appropriate lawful basis.

A typical assessment can consider:

• Purpose test: what legitimate interest is being pursued?
• Necessity test: is the processing necessary to achieve that purpose?
• Balancing test: does the organisation's interest outweigh the relevant interests, rights and freedoms of the data subject?

Organisations should document the assessment and review it when the processing changes.

Data Protection Officer (DPO)

The NDPA establishes requirements concerning Data Protection Officers.

DPO responsibilities can include:

• Advising the organisation
• Supporting compliance
• Monitoring data-protection obligations
• Supporting DPIAs
• Supporting data-subject rights
• Liaising with the regulator
• Supporting privacy governance
• Monitoring compliance activities

The 2025 GAID provides additional requirements around DPO credential assessment and certification.

Organisations should determine whether their circumstances require a DPO and ensure that the appointed person has appropriate competence and independence for the role.

Data controllers and data processors

The NDPA distinguishes between data controllers and data processors.

A data controller determines the purposes and means of processing personal data. Examples include:

• Employers
• E-commerce businesses
• Banks
• SaaS companies
• Healthcare organisations
• Online platforms

A data processor processes personal data on behalf of a controller. Examples include:

• Cloud providers
• Hosting providers
• CRM platforms
• Email providers
• Analytics services
• Customer-support platforms
• Payroll providers

Controllers should maintain appropriate oversight of processors and establish appropriate contractual and security controls.

Data controllers and processors of major importance

The NDPA provides for the designation and registration of Data Controllers and Data Processors of Major Importance (DCPMIs).

Current NDPC registration guidance states that an organisation may be considered of major importance based on factors including processing more than 200 data subjects in six months, providing certain commercial ICT services involving storage of personal data, or operating in specified sectors.

The current guidance also identifies sectors including:

• Aviation
• Communications
• Education
• Other designated sectors and circumstances

Because the NDPC's designation framework can depend on the specific activity and applicable regulatory guidance, organisations should assess their current status against the latest NDPC requirements.

NDPA registration

Data controllers and processors that fall within the applicable major-importance registration framework may be required to register with the NDPC.

Registration requirements can involve:

• Organisation details
• Processing activities
• Data categories
• Data-subject categories
• DPO information
• Compliance documentation
• Other information prescribed by the Commission

The NDPC currently provides registration services for Data Controllers and Processors of Major Importance.

Compliance Audit Returns

The NDPC requires applicable organisations to participate in compliance processes established under the Act and its regulatory framework.

The Commission states that certain DCPMIs are subject to Compliance Audit Returns (CAR) requirements.

The NDPC also states that CAR filings are submitted through a Licensed Data Protection Compliance Organisation (DPCO) where applicable.

Organisations should therefore distinguish between:

• Internal privacy compliance
• NDPC registration
• Compliance Audit Returns
• DPCO verification
• DPO governance

These are related but distinct compliance activities.

Data Protection Compliance Organisations (DPCOs)

The NDPA provides for licensed Data Protection Compliance Organisations.

DPCOs can provide services including:

• Data-protection training
• Auditing
• Consulting
• Compliance services
• Verification of compliance filings

The NDPC states that filings by data controllers under the Act may require a DPCO verification statement where applicable.

ConsentX can complement professional compliance services by providing technical consent, tracker and privacy-management infrastructure.

Data security under the NDPA

Data controllers and processors must implement appropriate security measures.

Security programmes should address areas such as:

• Access control
• Authentication
• Encryption
• Network security
• Data minimisation
• Secure development
• Vendor management
• Backup and recovery
• Incident response
• Employee awareness
• Security monitoring

The NDPA treats security as a core part of data protection rather than a separate technical issue.

Data breach notification

The NDPA establishes obligations concerning personal-data breaches.

Where a breach is likely to result in a risk to the rights and freedoms of individuals, the controller must notify the Commission within 72 hours of becoming aware of the breach.

The breach framework also addresses notification to affected data subjects where appropriate.

Organisations should maintain a documented incident-response process covering:

• Detection
• Containment
• Investigation
• Risk assessment
• Regulatory notification
• Data-subject notification
• Remediation
• Documentation

Cross-border data transfers

The NDPA regulates transfers of personal data outside Nigeria.

Organisations transferring personal data internationally should assess:

• Destination country
• Recipient organisation
• Transfer purpose
• Categories of personal data
• Data-subject risks
• Applicable safeguards
• Contractual protections
• Regulatory requirements

The 2025 GAID specifically includes assessment of the legal grounds for cross-border data transfers as part of compliance activities.

International organisations should therefore include Nigeria in their broader transfer-governance framework.

Data retention and deletion

Organisations should establish appropriate retention periods based on:

• Processing purpose
• Legal obligations
• Contractual requirements
• Regulatory requirements
• Litigation requirements
• Security requirements
• Data-subject rights

Once personal data is no longer required and there is no legal reason to retain it, organisations should implement appropriate deletion, destruction or anonymisation procedures.

A documented retention schedule can help demonstrate accountability.

Children and minors

Organisations processing children's personal data should apply additional care and consider:

• Age
• Capacity
• Parental or guardian involvement where applicable
• Nature of the processing
• Risk to the child
• Purpose of processing
• Appropriate safeguards
• Transparency

Children's data can create heightened privacy and safety risks, particularly in online services, education, gaming, social platforms and advertising.

Direct marketing under the NDPA

Marketing activities can involve extensive personal-data processing.

Examples include:

• Email marketing
• SMS marketing
• Customer profiling
• Behavioural advertising
• Retargeting
• Audience segmentation
• Personalised advertising

Organisations should identify the applicable lawful basis and ensure that the processing is consistent with transparency and data-subject rights.

Where consent is the applicable basis, the consent should be appropriately captured and recorded.

Privacy by design

Privacy should be incorporated into systems and processes from the beginning.

A privacy-by-design programme can include:

• Data minimisation
• Purpose limitation
• Consent management
• Privacy notices
• Access controls
• Retention controls
• Encryption
• Vendor governance
• DSAR workflows
• Audit logging
• International-transfer controls

The NDPC has also published materials promoting privacy by design in innovation and digital environments.

NDPA enforcement

The NDPC is responsible for supervising and enforcing the Nigeria Data Protection Act.

The Commission can investigate potential violations and apply regulatory measures.

Consequences of non-compliance can include:

• Remedial orders
• Administrative sanctions
• Compensation
• Remedial fees
• Other enforcement measures
• Civil proceedings
• Criminal consequences in applicable circumstances

The NDPC states that data subjects may also bring civil actions concerning violations of their rights.

NDPA penalties

Section 48 establishes different maximum penalty levels depending on whether the organisation is a Data Controller or Processor of Major Importance.

The NDPC states that for a DCPMI, the penalty or remedial fee can be up to the greater of NGN 10 million or 2% of annual gross revenue in the preceding financial year.

For organisations that are not of major importance, the NDPC states that the standard maximum can be the greater of NGN 2 million or 2% of annual gross revenue in the preceding financial year.

These are statutory maximum frameworks rather than an automatic fine for every violation. The actual regulatory outcome depends on the applicable circumstances and enforcement provisions.

NDPA compliance checklist

Use this checklist to assess your organisation's readiness.

• Map personal-data processing
• Identify data controllers
• Identify data processors
• Determine applicable lawful bases
• Identify sensitive or high-risk processing
• Review privacy notices
• Review cookies and trackers
• Determine where consent is required
• Ensure consent is freely given and informed
• Maintain consent records
• Provide applicable consent-withdrawal mechanisms
• Establish DSAR procedures
• Monitor the applicable 30-day response period
• Implement security controls
• Establish breach-response procedures
• Assess DPIA requirements
• Conduct LIAs where applicable
• Appoint a DPO where required
• Assess DCPMI status
• Complete NDPC registration where required
• Review Compliance Audit Return obligations
• Assess international transfers
• Establish retention periods
• Implement deletion procedures
• Review processor contracts
• Maintain compliance documentation
• Monitor NDPC guidance and regulatory updates

Why NDPA consent management matters

Privacy compliance for a modern website involves more than publishing a privacy policy.

A website may contain:

• Analytics tools
• Advertising pixels
• Social-media trackers
• Marketing tags
• Session-recording software
• Personalisation tools
• Embedded content
• CRM integrations
• Third-party APIs

Without visibility and control, these technologies can create privacy risks.

A consent-management platform can help organisations discover → categorise → obtain consent → block → record → manage preferences → demonstrate evidence.

ConsentX brings these controls together for organisations operating across multiple privacy jurisdictions.