You collect customer names, store email addresses. You process payments. Maybe you run a website with a contact form.

If any of that sounds familiar, Nigerian data protection law applies to your business, and you need to understand exactly what that means before a regulator comes knocking.

This guide breaks down everything you need to know about NDPR compliance. By the end, you will understand what is required, who it applies to, how to build a working compliance framework, and what happens if you ignore it.

What NDPR Compliance Actually Means for Nigerian Businesses

The Nigeria Data Protection Regulation (NDPR) was issued in 2019 by the National Information Technology Development Agency (NITDA). It is the primary Nigeria data protection law that governs how organizations collect, store, use, and share personal data.

NDPR compliance means your business handles personal data in a way that is lawful, transparent, and secure.

Personal data includes any information that can identify a living person. Full names, phone numbers, email addresses, bank details, IP addresses, and even device identifiers all count.

If your business touches any of that data, you are covered by this regulation.

Who Qualifies as a Data Controller and Data Processor Under NDPR

Before you can comply, you need to know where you stand.

A data controller is any individual or organisation that decides why and how personal data is processed. If you run a business that collects customer information, you are a data controller.

A data processor is any party that processes data on behalf of a controller. Cloud service providers, payroll companies, and third-party analytics tools often act as data processors.

You can be both at the same time, depending on the context.

Understanding this distinction matters because your obligations under the NDPR requirements in Nigeria differ depending on your role.

The Core NDPR Requirements Nigeria Businesses Must Follow

Here is what the regulation actually demands. These are not suggestions. They are legal obligations.

1. Lawful Basis for Processing

You must have a valid lawful basis for processing before you collect any personal data. The NDPR recognises several bases, including consent, contract performance, legal obligation, and legitimate interest.

You cannot collect data just because it is convenient. There must be a documented reason.

When consent is your lawful basis, it must be freely given, specific, informed, and unambiguous. Pre-ticked boxes do not count. Bundled consent does not count. You must be able to prove consent was properly obtained.

3. Privacy Notice

Every organisation collecting personal data must publish a clear privacy policy. It should explain what data you collect, why you collect it, how long you keep it, and who you share it with.

4. Data Subject Rights

Individuals have the right to access their data, correct inaccuracies, request deletion, and object to certain types of processing. Your business must have a process to respond to these requests within 30 days.

5. Data Security

You are required to implement appropriate technical and organisational measures to protect personal data from unauthorised access, loss, or breach.

6. Third-Party Agreements

If you share data with processors, you must have a written data processing agreement in place. Verbal arrangements do not satisfy this requirement.

How to Comply with NDPR: A Step-by-Step Checklist for Businesses

Use this NDPR checklist for businesses as your starting point.

Documentation is not optional. If NITDA investigates your organisation, your records are your defence.

NDPR Audit Requirements: What to Expect and How to Prepare

NDPR Audit Requirements

The regulation requires organisations that process data for more than 2,000 data subjects annually to submit a Data Protection Audit report to NITDA every 12 months.

This audit must be conducted by a licensed Data Protection Compliance Organisation (DPCO).

NDPR audit requirements include a review of your data processing activities, privacy documentation, consent mechanisms, data subject request processes, and security controls.

You submit the audit report through a DPCO, not directly to NITDA yourself.

If you have not filed your audit and you are above the threshold, you are already in breach.

Regulatory Requirements and Fines: What Non-Compliance Actually Costs

Understanding the regulatory requirements around data protection is not just about avoiding penalties. It is about building a business that people can trust.

Organisations that breach the NDPR face regulatory fines in Nigeria that scale with their annual gross revenue.

For companies with annual gross revenue above 10 million naira, the penalty can reach 2% of annual gross revenue or 10 million naira, whichever is higher.

For organisations below that revenue threshold, the penalty is up to 2% of annual gross revenue or 2 million naira, whichever is higher.

Beyond fines, NITDA can issue public notices, restrict your data processing activities, and refer cases for criminal prosecution in serious situations.

The cost of data protection compliance is far lower than the cost of getting it wrong.

Frequently Asked Questions

Does NDPR apply to small businesses?

Yes. If your business collects personal data from Nigerian residents, NDPR applies regardless of your company’s size. The audit filing threshold is based on data volume, but the compliance obligations apply to all.

What is a Data Protection Officer and do I need one?

A Data Protection Officer (DPO) is a person responsible for overseeing your organisation’s data protection strategy. NDPR requires organisations that process personal data on a significant scale to appoint one. Even where not strictly mandatory, appointing a DPO is considered best practice.

How do I register as a DPCO or find one to file my audit?

Data Protection Compliance Organisations are licensed by NITDA. You can find a registered DPCO through the NITDA official portal at nitda.gov.ng.

What is the difference between NDPR and the Nigeria Data Protection Act?

The Nigeria Data Protection Act (NDPA) was signed into law in 2023 and establishes the Nigeria Data Protection Commission (NDPC) as the primary regulatory body. The NDPR remains operative as a regulation. Organisations should monitor both instruments and align their compliance framework accordingly.

Conclusion

Data protection compliance is not a one-time task. It is an ongoing process that requires documentation, staff awareness, periodic audits, and regular policy reviews.

The businesses that struggle most are those that treat it as a checkbox exercise. The ones that do it properly build trust with their customers and avoid the disruption of regulatory investigations.

If you are unsure where your organisation stands right now, the smartest move is to get a proper compliance gap assessment before your next audit cycle.