Understanding the Nigeria Data Protection Act (NDPA) 2023

On 12 June 2023, President Bola Ahmed Tinubu signed the Nigeria Data Protection Act into law, replacing the NDPR 2019 as the primary data protection legislation in Nigeria. For developers building applications that handle Nigerian users' personal data, this is not something you can afford to ignore. Under Section 48(4), penalties can reach the higher of 10 million Naira or 2% of annual gross revenue for data controllers and processors of major importance, and the higher of 2 million Naira or 2% for everyone else.

This guide breaks down the NDPA from a developer's perspective — what you need to know, what you need to build, and how the NDPA Toolkit can help.

What is the NDPA 2023?

The NDPA is Nigeria's comprehensive data protection law. It establishes the Nigeria Data Protection Commission (NDPC) as the independent regulatory body responsible for enforcement. Unlike the NDPR, which was a subsidiary regulation under NITDA, the NDPA is a full Act of the National Assembly with stronger enforcement mechanisms and clearer obligations.

Key Differences from NDPR 2019

| Aspect | NDPR 2019 | NDPA 2023 | |--------|-----------|-----------| | Legal Status | Subsidiary regulation | Full Act of parliament | | Regulator | NITDA | NDPC (independent body) | | Lawful Bases | Consent-focused | 6 defined bases (Section 25) | | Breach Notification | 72 hours to NITDA | 72 hours to NDPC (Section 40) | | Cross-Border | NITDA approval | Adequacy framework (Section 42) | | Data Subject Rights | 5 basic rights | 8 expanded rights (Sections 34-38) | | Penalties | Up to 2% of revenue | Higher of 2% of revenue or N10M (major importance) / N2M (others) | | DPO Requirement | Encouraged | Mandatory for certain controllers | | DPIA | Recommended | Required for high-risk processing |

The 6 Lawful Bases (Section 25)

Under the NDPA, you cannot process personal data without a lawful basis. Section 25 defines six:

1. Consent — The data subject has given clear, informed consent for a specific purpose. This is the basis most developers will use for marketing, analytics, and non-essential processing. See our consent management best practices for implementation details.

2. Contract — Processing is necessary to fulfil a contract with the data subject. Think order processing, account management, or service delivery.

3. Legal Obligation — You are required by Nigerian law to process the data. Tax records, KYC requirements under CBN regulations, and anti-money laundering obligations fall here.

4. Vital Interest — Processing is necessary to protect someone's life. This is narrow and typically applies to emergency medical situations.

5. Public Interest — Processing is necessary for a task carried out in the public interest or in the exercise of official authority.

6. Legitimate Interest — The controller has a legitimate interest that is not overridden by the data subject's rights. This requires a balancing test and proper documentation.

Using the toolkit, you can track which basis applies to each processing activity:

import { LawfulBasisTracker } from '@tantainnovative/ndpr-toolkit/lawful-basis';

<LawfulBasisTracker
  activities={[
    {
      name: 'User Registration',
      basis: 'contract',
      description: 'Processing necessary to create user account',
      dataCategories: ['name', 'email', 'phone'],
    },
    {
      name: 'Marketing Emails',
      basis: 'consent',
      description: 'Promotional communications to users',
      dataCategories: ['email', 'preferences'],
    },
  ]}
/>

The 8 Data Subject Rights

The NDPA sets out the rights available to data subjects in Part VI, Sections 34-38:

1. Right of Access (Section 34(1)(a)–(b)) — Data subjects can request a copy of their personal data.
2. Right to Rectification (Section 34(1)(c)) — They can request correction of inaccurate data.
3. Right to Erasure (Section 34(1)(d) and 34(2)) — They can request deletion of their data in certain circumstances.
4. Right to Restrict Processing (Section 34(1)(e)) — They can ask you to stop processing temporarily.
5. Right to Data Portability (Section 38) — They can request their data in a machine-readable format.
6. Right to Object (Section 36) — They can object to processing based on legitimate interest or public interest.
7. Right Against Automated Decision-Making (Section 37) — They have the right not to be subject to decisions based solely on automated processing.
8. Right to Withdraw Consent (Section 35) — They can withdraw consent at any time, and withdrawal must be as easy as giving consent.

import { DataSubjectRightsForm } from '@tantainnovative/ndpr-toolkit/dsr';

<DataSubjectRightsForm
  onSubmit={handleRequest}
  rights={['access', 'rectification', 'erasure', 'portability', 'objection']}
/>

Breach Notification: The 72-Hour Deadline

Section 40 of the NDPA requires data controllers to notify the NDPC of a personal data breach within 72 hours of becoming aware of it. If the breach is likely to result in high risk to the rights of data subjects, you must also notify the affected individuals without undue delay.

This is not optional, and the clock starts ticking the moment you become aware. The toolkit's BreachNotification module includes timeline tracking to help you stay within the 72-hour window:

import { BreachNotificationForm } from '@tantainnovative/ndpr-toolkit/breach';

<BreachNotificationForm
  onSubmit={handleBreachReport}
  regulatoryBody="NDPC"
  notificationDeadlineHours={72}
/>

Cross-Border Transfer Requirements

Part VIII (Sections 41-43) restricts the transfer of personal data outside Nigeria. Section 41 permits a transfer where the recipient is subject to adequate protection, for example through contractual clauses or binding corporate rules; Section 42 sets out how adequacy is assessed; and Section 43 lists the derogations, such as informed consent, that apply when adequate protection is absent. This affects any application that uses cloud infrastructure outside Nigeria or shares data with international partners.

The toolkit's CrossBorderTransfer module walks you through the adequacy assessment:

import { CrossBorderAssessment } from '@tantainnovative/ndpr-toolkit/cross-border';

<CrossBorderAssessment
  transferDetails={{
    destinationCountry: 'United States',
    dataCategories: ['user profiles', 'transaction data'],
    transferMechanism: 'standard-contractual-clauses',
  }}
/>

How the Toolkit Helps

Every component in the NDPA Toolkit is mapped to specific sections of the NDPA 2023. You do not need to read the entire 80-page Act to build compliant features. The toolkit handles the legal requirements, you handle the user experience.

Get started with the documentation or explore the interactive demos.

The NDPA Toolkit is open-source and available on GitHub and npm. For a practical implementation walkthrough, see the developer's compliance checklist.