Nigeria: Implemented Data Protection Act, 2023 (Act No. 37) including registration obligation for data controllers and processors of major importance

On 1 October 2024, the obligation for data controllers and processors of major importance to register with the Nigeria Data Protection Commission (NDPC) under the Data Protection Act entered into force. The Act required controllers and processors meeting the criteria established by the NDPC to register by 12 December 2023 and provide information on the risks, safeguards, and security measures adopted to protect the data stored. The NDPC issued a guidance outlining criteria and obligations. The NDPC’s guidance postponed the deadline for registration, initially set as 6 months after the Data Protection Act’s commencement (i.e. 30 September 2024).