"Which organisation is the regulator of data protection in Nigeria?" It's one of the most common questions people type into Google about the NDPA.
It sounds simple, but the answer has changed twice in a few years, so a lot of people are still working from old information. Some still think it's NITDA. Others have heard of a "Bureau" and aren't sure if it still exists.
This guide gives you the plain-English answer: who the regulator is, what it does, how it enforces the law, and how your organisation actually deals with it.
The short answer
The regulator of data protection in Nigeria is the Nigeria Data Protection Commission (NDPC).
It's a federal government body set up by the Nigeria Data Protection Act (NDPA) 2023, and it's responsible for enforcing that Act across the country. It's led by a National Commissioner, who is also its Chief Executive. That's currently Dr Vincent Olatunji, who has led Nigeria's data protection authority since 2022.
So why the confusion? Because the job has moved between three bodies in a few years:
| Period | Who regulated data protection | Under what |
|---|---|---|
| 2019 to early 2022 | NITDA (National Information Technology Development Agency) | NDPR 2019 |
| Feb 2022 to June 2023 | Nigeria Data Protection Bureau (NDPB) | NDPR 2019 |
| June 2023 to now | Nigeria Data Protection Commission (NDPC) | NDPA 2023, and the GAID 2025 since September 2025 |
The Bureau became the Commission when the NDPA was signed. NITDA still regulates IT more broadly, but data protection is now NDPC's job.
Sources: NDPC news, Voice of Nigeria, Wikipedia on Vincent Olatunji
What the NDPC actually does
The NDPA gives the Commission a wide mandate. In practice, its work falls into five areas:
- Sets the rules. It issues regulations, directives and guidance on how to apply the Act. The GAID 2025 is the biggest example so far.
- Registers organisations. Data controllers and processors of major importance must register with NDPC and renew every year.
- Licenses DPCOs. NDPC licenses the Data Protection Compliance Organisations that audit, train and advise businesses, and those DPCOs file audit returns on clients' behalf.
- Handles complaints. Anyone who thinks their personal data has been misused can complain to NDPC, and it can investigate.
- Enforces the law. It can investigate organisations, order them to fix problems and impose penalties.
It also runs public awareness campaigns and trains data protection officers, including those in government ministries and agencies.
How the NDPC enforces the law
NDPC isn't just a paperwork office. It investigates, and it fines.
For data controllers and processors of major importance, the penalty for breaking the NDPA can reach ₦10 million or 2% of the organisation's annual gross revenue from the previous year, whichever is higher.
Two cases show how seriously it takes this:
- Fidelity Bank, ₦555.8 million (2024). A customer complained that their data had been used to open an account without a lawful basis. NDPC then reviewed the bank's platforms and said it found processing without informed consent, cookies and banking apps used in breach of the Act, and reliance on non-compliant third-party processors. The fine was 0.1% of the bank's 2023 gross revenue. Fidelity Bank disputed the findings.
- MultiChoice Nigeria, ₦766.2 million (2025). After an investigation that began in 2024, NDPC fined the company over how it handled subscriber data, including cross-border transfers. The Commissioner also ordered a compliance audit of every outlet where MultiChoice collects Nigerians' data.
In both cases, NDPC criticised the company's cooperation during the investigation, and for Fidelity Bank it said this made the penalty heavier. The lesson for any organisation: when NDPC writes to you, respond quickly and fully.
Sources: Channels TV, Techbuild Africa, ICIR, IT Edge News
Who the NDPC watches
The NDPA applies to almost any organisation that handles personal data of people in Nigeria. It sorts them into two roles:
- Data controllers decide why and how personal data is processed. A bank deciding what customer data to collect is a controller.
- Data processors handle data on a controller's behalf. A payroll or cloud provider working for that bank is a processor.
NDPC pays the closest attention to controllers and processors "of major importance". Under the GAID 2025, these fall into three levels:
| Level | Typical examples |
|---|---|
| Ultra-High Level (UHL) | Commercial banks, telcos, insurers, fintechs, payment gateways, oil and gas, or anyone processing data of more than 5,000 people in 6 months |
| Extra-High Level (EHL) | Government ministries and agencies, microfinance and mortgage banks, universities, secondary and tertiary hospitals, or anyone processing data of 1,000 to 5,000 people in 6 months |
| Ordinary-High Level (OHL) | Smaller organisations that still process a meaningful amount of personal data |
Your level decides what you owe NDPC: whether you register, whether you file an annual audit return, and what fees you pay.
How your organisation deals with the NDPC
If you're a controller or processor of major importance, these are the touchpoints you'll have with the Commission:
- Register, then renew every year. Registration is done with NDPC directly.
- Appoint a Data Protection Officer. Someone in or outside your organisation who owns compliance and is the contact for NDPC.
- File your Compliance Audit Return by 31 March. This must go through a licensed DPCO, which submits it on NDPC's portal on your behalf.
- Report breaches within 72 hours. If personal data is compromised, NDPC must hear from you within 72 hours of you becoming aware.
- Cooperate with investigations. If NDPC writes to you, respond on time and in full. As the cases above show, a slow or dismissive response can make things worse.
When choosing a DPCO, ask to see their NDPC licence before you sign anything.
If you're an individual who thinks your data has been misused, you can complain to the organisation first, then escalate to NDPC. The Commission's website, ndpc.gov.ng, has its contact details.
FAQs
Which organisation is the regulator of data protection in Nigeria?
The Nigeria Data Protection Commission (NDPC), set up by the Nigeria Data Protection Act 2023.
Is NITDA still the data protection regulator?
No. NITDA issued the NDPR in 2019, but data protection moved to the Nigeria Data Protection Bureau in 2022 and then to the NDPC in 2023.
Who heads the NDPC?
The National Commissioner and Chief Executive, currently Dr Vincent Olatunji.
Can the NDPC fine my company?
Yes. For organisations of major importance, fines can reach ₦10 million or 2% of the previous year's annual gross revenue, whichever is higher.
How do I report a data protection complaint in Nigeria?
Raise it with the organisation first. If it isn't resolved, you can complain to the NDPC through the contact details on ndpc.gov.ng.
The bottom line
One regulator: the NDPC. One law: the NDPA 2023, applied through the GAID 2025. If someone tells you NITDA or the Bureau is in charge, their information is a few years out of date.
For DPCOs, the NDPC is the body you answer to on every client's behalf. DPO Copilot helps your team keep every client's audit evidence, CAR readiness and data subject requests in order, so you're ready whenever the Commission comes asking. See how at www.dpocopilot.ng, or email info@dpocopilot.ng.
DPO Copilot is powered by Bitechnologies.