Search Google for Nigeria's data protection law and you'll see people looking for the "Nigeria Data Protection Act 2024", the "Act 2025", even "2024 PDF download".
Here's the thing: those laws don't exist.
The confusion is understandable. Nigeria's data protection rules have changed a lot in a short time. There was a regulation in 2019, an Act in 2023, and a big implementation directive in 2025. If you're a business owner, a DPO or a new compliance hire, it's easy to lose track of which document actually applies.
This post clears it up. You'll learn which law is in force, what came before it, what the 2025 directive changed, and where to download the official documents.
The short answer
The main data protection law in Nigeria is the Nigeria Data Protection Act (NDPA) 2023. There is no NDPA 2024 and no NDPA 2025.
What people usually mean when they search for a "2025 Act" is the General Application and Implementation Directive (GAID) 2025. It's not a new Act. It's a directive from the Nigeria Data Protection Commission (NDPC) that explains how to apply the NDPA 2023 in practice.
So today, two documents work together:
- The NDPA 2023 sets the law: your obligations, data subjects' rights and the penalties.
- The GAID 2025 sets the details: who must register, how audits work, which templates to use and what fees to pay.
If the two ever conflict, the Act wins.
How Nigeria got here
Nigeria went from a regulation to a full Act to a detailed directive in under seven years. Here's the run, newest first:
| Date | What happened | Why it matters |
|---|---|---|
| 19 Sep 2025 | GAID 2025 takes effect | The NDPR 2019 and its framework stop applying. The NDPA and GAID are now the rules. |
| 20 Mar 2025 | NDPC issues the GAID 2025 | Detailed guidance on how to apply the NDPA 2023 |
| 12 Jun 2023 | NDPA 2023 signed into law | Nigeria's first data protection Act. It creates the NDPC. |
| 4 Feb 2022 | Nigeria Data Protection Bureau starts work | Takes over data protection from NITDA until the Act arrives |
| Nov 2020 | NDPR Implementation Framework | NITDA's guide to applying the NDPR |
| 25 Jan 2019 | NITDA issues the NDPR 2019 | Nigeria's first dedicated data protection rules |
So if you see the NDPR 2019 quoted in an old policy or contract, it's out of date. The current references are the NDPA 2023 and the GAID 2025.
Sources: Isa Pantami on the journey to the NDPA, Hogan Lovells on the NDPA 2023, Afriwise on the GAID taking effect
What the GAID 2025 actually changed
The GAID didn't replace the NDPA. It filled in the practical details the Act left open. The changes most organisations feel are these:
- The NDPR is retired. From 19 September 2025, NDPC applies only the NDPA and the GAID.
- Clear risk categories. Organisations of major importance are grouped as Ultra-High, Extra-High or Ordinary-High Level, based on sector and how many people's data they process.
- Registration with NDPC. Data controllers and processors of major importance must register with the Commission.
- New audit rules. Compliance Audit Returns now follow a standard template (Schedule 2), with revised thresholds and new filing fees (Schedule 10). They're due by 31 March every year and must be filed through a licensed DPCO.
- A standard DPIA template. Organisations now have one format for data privacy impact assessments.
- Breach reporting within 72 hours. Personal data breaches must be reported to NDPC within 72 hours of becoming aware.
- Complaint channels. Organisations need a clear way for people to raise data complaints, with escalation to NDPC if needed.
One useful detail from NDPC's FAQs: an Ordinary-High Level organisation processing data of fewer than 200 people doesn't file a CAR, but must still renew its registration every year.
Sources: the GAID 2025, NDPC FAQs, Afriwise, Mondaq summary of the GAID
Where to download the official documents
Skip the random PDF sites. Both documents are free on NDPC's own website:
| Document | What it is | Official link |
|---|---|---|
| Nigeria Data Protection Act 2023 | The law itself | Download from NDPC |
| NDP Act GAID 2025 | NDPC's directive on applying the Act | Download from NDPC |
| NDPC FAQs | Quick answers on registration and audits | Read on NDPC |
Always check the NDPC site before relying on a copy someone sent you. Unofficial PDFs can be outdated or edited.
What this means for you
If you run an organisation: update any privacy policy, contract or staff training that still quotes the NDPR 2019. Check which GAID category you fall into, because that decides whether you register, file a CAR and what you pay.
If you're a DPO or compliance lead: make the NDPA 2023 and GAID 2025 your two reference points. Every policy, DPIA and audit finding should map back to them.
If you run a DPCO: expect clients to come to you confused about the "2024" or "2025" law. A short explainer like this one is a good thing to send them before an audit kick-off.
Keeping every client's records aligned to the current rules is a lot of manual work. That's why we built DPO Copilot around the NDPA 2023 and GAID 2025, with a regulatory library kept up to date as NDPC issues new guidance.
FAQs
Is there a Nigeria Data Protection Act 2024 or 2025?
No. The only data protection Act is the NDPA 2023. The 2025 document people mean is the GAID 2025, a directive issued by NDPC under the Act.
Where can I download the NDPA 2023 PDF?
For free on NDPC's website, at ndpc.gov.ng. The GAID 2025 is there too.
Which organisation regulates data protection in Nigeria?
The Nigeria Data Protection Commission (NDPC), created by the NDPA 2023. It replaced the Nigeria Data Protection Bureau.
Is the NDPR 2019 still valid?
No. Since the GAID took effect on 19 September 2025, NDPC applies only the NDPA 2023 and the GAID 2025.
Can my organisation get a data protection certificate in Nigeria?
NDPC may issue a Compliance Audit Returns Certificate once an organisation files its CAR through a licensed DPCO. NDPC also licenses the DPCOs themselves.
The bottom line
One Act, one directive. The NDPA 2023 is the law, and the GAID 2025 explains how to follow it. Anything labelled "NDPA 2024" or "NDPA 2025" is a mix-up.
If you're a DPCO keeping many clients aligned to these rules, see how DPO Copilot helps at www.dpocopilot.ng, or email info@dpocopilot.ng.
DPO Copilot is powered by Bitechnologies.