NDPA Penalties: What Nigerian Businesses Need to Know in 2026

If you run a business in Nigeria that collects customer data — names, email addresses, phone numbers, payment details, delivery addresses — the Nigeria Data Protection Act (NDPA) 2023 applies to you. And the penalties for getting it wrong are not theoretical. The Nigeria Data Protection Commission (NDPC) has the legal authority to impose fines of up to 2% of your annual gross revenue or 10 million Naira, whichever is greater.

This is not a developer problem or an IT problem. This is a business risk that every Nigerian business owner needs to understand.

How the NDPA Penalty Structure Works

The NDPA establishes a tiered penalty framework based on the size and nature of the data controller:

For large data controllers (businesses processing data of more than a specified threshold of data subjects, or with annual gross revenue above a certain level), the maximum penalty is 2% of annual gross revenue or 10 million Naira, whichever is greater.

For smaller data controllers, penalties are proportionate but still significant. A fine of even a few hundred thousand Naira can be devastating for a small business operating on thin margins.

Beyond financial penalties, the NDPC can issue enforcement notices requiring you to stop processing data entirely. For a business that depends on customer data for daily operations — which today is nearly every business — a processing ban can be more damaging than the fine itself.

What Triggers NDPC Enforcement

The NDPC does not need to catch you in the act. Enforcement actions are typically triggered by:

Data breach reports. If your business suffers a data breach and you fail to report it within 72 hours, that failure is itself a violation. If customers' personal data is exposed and you did not have adequate security measures, that is another violation.

Data subject complaints. Any Nigerian citizen whose personal data you process can file a complaint with the NDPC. If a customer asks you to delete their data and you ignore the request, they can escalate to the Commission.

Proactive audits. The NDPC has the power to conduct compliance audits. Sectors that handle sensitive data — fintech, healthtech, e-commerce, and HR services — are higher-priority targets.

Whistleblowers and public reports. Media coverage of a data leak, a disgruntled employee, or a competitor's tip-off can all lead to an investigation.

Real Examples of Compliance Failures

Consider a Lagos-based e-commerce company that stores customer addresses and payment information. A disgruntled former employee downloads the customer database and the data appears on the open internet. The company does not notice for two weeks, and when they do, they try to handle it internally without notifying the NDPC.

This single incident creates multiple violations: failure to implement adequate security measures, failure to notify the NDPC within 72 hours, and failure to notify affected customers. Each violation compounds the potential penalty.

Or consider a recruitment agency that collects CVs, medical records, and salary histories. They share candidate data with client companies without a clear lawful basis and without informing candidates of who will receive their information. A candidate complains to the NDPC. The agency now faces enforcement action not just for the single complaint but for a systemic compliance failure.

These scenarios are not hypothetical. They reflect the types of cases data protection authorities across Africa and globally are actively pursuing.

The 72-Hour Breach Notification Deadline

Section 40 of the NDPA gives you exactly 72 hours from the moment you become aware of a personal data breach to notify the NDPC. Not 72 business hours — 72 hours. That means if you discover a breach on Friday evening, your deadline is Monday evening.

The notification must include the nature of the breach, the categories of data affected, the approximate number of data subjects affected, the likely consequences, and the measures you have taken to address the breach.

Most businesses that miss this deadline do so because they do not have a breach response plan in place. They waste the first 48 hours trying to figure out what happened, and by the time they are ready to report, the window has closed.

Having a documented breach response procedure is not just good practice — it is a practical necessity. The NDPA Toolkit's breach notification module provides a structured process and timeline tracker to help you meet this deadline.

Why Early Compliance Saves Money

Every month you delay compliance, you increase your exposure. The cost of compliance is predictable and manageable. The cost of a penalty, a data breach, or a processing ban is not.

Here is what early compliance looks like in practice:

Audit your data. Know what personal data you collect, where it is stored, who has access, and why you need it. This is called a Record of Processing Activities (ROPA), and it is the foundation of compliance.

Establish lawful bases. For each type of data processing, identify your lawful basis under Section 25 of the NDPA. If you are relying on consent, make sure it meets the NDPA's strict requirements — freely given, specific, informed, and unambiguous.

Update your privacy policy. Your privacy policy must reflect what you actually do with personal data, written in plain language that your customers can understand.

Implement consent collection. If any of your processing activities rely on consent, you need a mechanism to collect, record, and manage that consent — including the ability for customers to withdraw it.

Set up breach response procedures. Document who does what when a breach occurs. Assign roles, create templates, and test the process before you need it.

How to Get Started

You do not need to hire an expensive law firm or consultancy to begin. The NDPA Toolkit provides free, open-source tools to help Nigerian businesses understand and implement the core requirements of the NDPA.

Start with the interactive compliance demos to see what compliant consent collection, data subject rights handling, and breach notification look like in practice. Then read the documentation for step-by-step guidance on implementing each requirement.

The businesses that take data protection seriously now will be the ones that avoid penalties, earn customer trust, and build a competitive advantage as Nigeria's data protection landscape matures.

---

The NDPA Toolkit is open-source and available on GitHub. Built for Nigerian businesses by Nigerian developers.