The National Data Protection Act (NDP Act) will come into full effect in September 2025, while all provisions relating to fees will commence in January 2026. This was revealed by the National Commissioner/CEO, Nigeria Data Protection Commission (NDPC), Dr. Vincent Olatunji, at a media briefing in Abuja on Wednesday, at the issuance of Nigeria Data Protection Act – General Application And Implementation Directive (NDP ACT-GAID), 2025.
The NDP ACT-GAID 2025 seeks to act as an implementation guideline for the NDP Act.
The NDP Act GAID regulatory instrument addresses technical and organisational measures in the following areas among others:
- Data Protection Principles
- Lawful Bases of Data Processing
- Data Subjects’ Rights
- Material and Territorial Scope of the NDP Act
- Data Ethics
- Emerging Technologies
- NDP Act Compliance Audit Returns
- Data Privacy Impact Assessment
- Cross-border Data Transfer
- Training and Certification of Data Protection Officers
- Benchmarking with global best practice
- Cooperation and Collaboration
- Alternative Dispute Resolution and
- Standardised Grievances Redress Mechanism.
Olatunji noted that the step is another milestone in Nigeria’s quest towards safeguarding the fundamental rights and freedoms of Nigerians in the context of data privacy and protection as we push in the frontiers of the 4th Industrial Revolution.
He said that the June 2023 assent to the Nigeria Data Protection Bill by President Bola Ahmed Tinubu gave the Nigeria Data Protection Commission (NDPC) the opportunity to implement strategies that will guarantee and secure the privacy of citizens, their homes, correspondence, telephone conversations and telegraphic communications.
By vigorously engaging all stakeholders, the Commission was able to set the framework for the NDP Act-GAID.
Speaking on this, Olatunji explained further: “It will be recalled that, on the 6th of September 2023, the Commission inaugurated a National Committee of technical experts drawn from the ecosystem and chaired by the Commission’s Head of Legal, Enforcement and Regulations. The mandate of the Committee was to draft the NDP Act General Application and Implementation Directive (NDP Act GAID). The Committee received both written and oral commentaries through various workshops, focus group discussions and through our various communication channels. The Commission held a validation workshop in Lagos on the 19th of June, 2024 and another one was held in Abuja on the 21st of August 2024. These engagements created a rich frame of reference in drafting the NDP Act-GAID, 2025.”
The quest to safeguard privacy rights in the context of emerging technologies such as Artificial Intelligence received attention in the NDP Act GAID. NDPC enjoined practitioners in this space to implement privacy by design and by default among other obligations.
“Furthermore, we have fully democratised privacy breach remediation process for data subjects. We achieved this by introducing data subjects’ Standard Notice to Address Grievance (SNAG) which empowers data subjects to use the instrumentality of the Commission to demand remedial action from data controllers and processors without first writing to the Commission.
This process makes over 230 million Nigerians our immediate and direct partners in ensuring adequacy of data protection in Nigeria. Through Automation, the SNAG will be accessible anywhere in all nooks and crannies of Nigeria and around the world,” Olatunji said.
While stating that with the issuance of the NDP Act GAID, no organisation can feign ignorance of its obligations under the law, Olatunji promised the Commission will continuously provide guidance notices and advisories to illustrate the requirements of law towards deepening the culture of data privacy and protection.
“We shall also be carrying out various capacity building programmes. In addition, we shall be taking feedbacks through our platforms. This will help the Commission in future reviews of the NDP Act GAID and in the issuance of new regulatory instruments. To this end, we propose to use our best endeavours” he concluded.
