Nigeria: Data Protection Commission's General Application and Implementation Directive including registration as a data controller or data processor of major importance requirement (NDPC/NDP ACT-GAID/01/2025) enters into force
Description
Data Protection Commission's General Application and Implementation Directive including registration as a data controller or data processor of major importance requirement (NDPC/NDP ACT-GAID/01/2025) enters into force
On 19 September 2025, the Nigeria Data Protection Commission’s (NDPC) General Application and Implementation Directive (GAID) 2025 (NDPC/NDP ACT-GAID/01/2025) under the Nigeria Data Protection Act (NDP Act) 2023 enters into force, mandating registration for data controllers and processors of major importance. Articles 8–9 and Schedule 7 classify entities into Ultra-High, Extra-High, and Ordinary-High levels, requiring annual registration and compliance audit returns (CAR) filings with prescribed fees.
Original sourceScope
Policy Area
Authorisation, registration and licensing
Policy Instrument
Business registration requirement
Regulated Economic Activity
infrastructure provider: internet and telecom services, infrastructure provider: cloud computing, storage and databases, infrastructure provider: network hardware and equipment, infrastructure provider: other
Implementation Level
national
Government Branch
executive
Government Body
data protection authority