Nigeria: Data Protection Commission's General Application and Implementation Directive including cross-border data transfer regulation (NDPC/NDP ACT-GAID/01/2025) enters into force

On 19 September 2025, the Nigeria Data Protection Commission’s (NDPC) General Application and Implementation Directive (GAID) 2025 (NDPC/NDP ACT-GAID/01/2025) under the Nigeria Data Protection Act (NDP Act) 2023 enters into force, regulating cross-border data transfers. The directive permits transfers only under conditions such as adequacy decisions, approved transfer instruments, or other lawful bases under Sections 41–43 of the NDP Act. Schedule 5 provides guidance on assessing foreign jurisdictions for adequacy, ensuring compliance with Nigerian data protection standards.