Nigeria Data Protection Act, 2023
Nigeria Data Protection Commission
Primary statutory source for controller and processor duties, data subject rights, DPIA, breach notification, ROPA, and cross-border transfer requirements.
Legal Sources & Update Governance
Official legal references, module mapping, and the process used to keep NDPR Toolkit aligned with Nigerian data protection guidance.
Scope
NDPR Toolkit is developer infrastructure for implementing Nigeria Data Protection Act workflows in React, Next.js, and server-side TypeScript applications. It is not a law firm, DPCO, or replacement for legal review. The goal is to encode repeatable implementation patterns and make the underlying legal assumptions visible to engineering teams.
Not legal advice
Treat toolkit output as implementation support. Before relying on it for regulated operations, confirm current obligations with counsel, a licensed DPCO, or the latest NDPC guidance.
Official sources tracked
NDP Act General Application and Implementation Directive, 2025
Nigeria Data Protection Commission
Operational source for DCPMI classification, Compliance Audit Returns, breach notification detail, and implementation expectations.
Guidance Notice on Registration of Data Controllers and Processors of Major Importance
Nigeria Data Protection Commission
Supplemental registration source used when reviewing DCPMI thresholds, classes, and filing assumptions.
NDPC Resources
Nigeria Data Protection Commission
Monitoring source for new notices, forms, consultation material, and updated guidance.
Module mapping
| Toolkit area | Primary reference | Implementation coverage |
|---|---|---|
| Consent management | NDPA S.25-S.26 | Specific, informed consent, lawful basis, withdrawal, and demonstrable records. |
| Data subject rights | NDPA Part VI, S.34-S.38 | Access, correction, erasure, portability, objection, and response workflow support. |
| Privacy policy generator | NDPA S.27 | Transparent privacy notices covering controller identity, purposes, rights, sharing, retention, and safeguards. |
| DPIA questionnaire | NDPA S.28 | Risk assessment workflow for high-risk processing and mitigation tracking. |
| ROPA | NDPA S.29 | Records of processing activities for purposes, categories, recipients, transfers, and retention. |
| Breach notification | NDPA S.40 / GAID 2025 Art. 33 | 72-hour NDPC readiness, content completeness, and high-risk data-subject notification checks. |
| Cross-border transfers | NDPA S.41-S.43 | Adequacy, safeguards, transfer basis, and approval-oriented evidence gathering. |
| DCPMI and CAR utilities | GAID 2025 / registration guidance | Major importance classification, fee baseline, and Compliance Audit Return schedule support. |
Update governance
| Cadence | Review action |
|---|---|
| Monthly | Check NDPC resources, notices, forms, and public guidance for changes that affect defaults, thresholds, or docs. |
| Release planning | Review module citations before minor releases and when adding compliance-sensitive exports. |
| Emergency | Cut a patch or minor release when NDPC changes deadlines, reporting content, registration tiers, fees, or enforcement-critical interpretation. |
| Annual | Run a full source review against NDPA, GAID, and NDPC notices before the first release of each calendar year. |
Each compliance-sensitive change should identify the affected module, source reference, source version or retrieval date, expected behavior, tests or docs updated, and whether the change requires a breaking release.
Release policy for regulatory changes
- Patch releases fix citations, copy, examples, false positives, and non-breaking validator behavior.
- Minor releases add new regulatory utilities, new checks, new module coverage, or stricter optional validation.
- Major releases are reserved for breaking API changes or materially different compliance assumptions.
- Deprecated behavior should remain documented for at least one minor release unless it is legally misleading.
Changelog taxonomy
Compliance-impacting release notes are separated from ordinary feature, bug, and docs changes so adopters can decide whether to update config, re-run audits, refresh evidence, or seek legal review.
| Heading | Use when |
|---|---|
| Features | Additive public APIs, components, hooks, routes, adapters, CLI behavior, or documented capabilities. |
| Bug Fixes | Corrections to shipped behavior, validation, packaging, security hardening, or regressions. |
| Documentation | Docs, examples, release guidance, legal citation wording, or site content that does not change package behavior. |
| Compliance Rule Changes | Changes to NDPA/NDPC/GAID assumptions, default thresholds, filing deadlines, citation mappings, scoring semantics, or compliance-sensitive validator behavior. |
What users should do after updates
- Watch GitHub Releases or npm version updates for compliance-impacting release notes.
- Read any Compliance Rule Changes entry before upgrading production compliance workflows.
- Re-run
ndpr auditafter upgrading if the change affects DCPMI, CAR, breach, score, or evidence behavior. - Refresh generated evidence or docs when citations, thresholds, deadlines, or source assumptions change.
- Confirm current NDPC guidance with counsel, a licensed DPCO, or the regulator before relying on outputs for filings.