Nigeria Data Protection Act 2023 — 20-question self-assessment checklist for businesses processing personal data in Nigeria. Get your compliance score instantly.
Click each item to mark as Yes, we comply. Your score updates in real time.
| Obligation | Deadline / Threshold |
|---|---|
| Breach notification to NDPC | Within 72 hours of discovery |
| Data subject rights response | Acknowledge within 72 hours; resolve within reasonable time |
| Annual audit report filing (major controllers) | By 15 March each year |
| DPO appointment (major controllers) | Immediate obligation on designation |
| NDPC registration (major controllers) | Within 6 months of designation |
| DPIA for high-risk processing | Before commencement of processing |
This workspace turns the ndpa control audit result into a reusable matter note, dashboard item and gated PDF checklist. Use the app first, then save the evidence trail.
Benchmarked against Termly, OneTrust and enterprise consent platforms. The goal is not to copy them; it is to bring the useful workflow pattern into an Africa-first tool with official-source caution and local evidence capture.
The checker is most useful when the score becomes a remediation list: lawful basis, privacy notice, data-subject rights, processor contracts, breach response, DPIA, registration and audit evidence.
Before filing, signing, publishing, or sending anything, keep a short record that links the app result to evidence and official-source checks.
Save the country or regime, parties, dates, amounts, selected options, and final output. Add why this matters: Whether the business is likely to be a data controller or processor of major importance.
Keep a register of processing activities before answering the checklist. Also keep the strongest supporting document, receipt, portal reference, ID, contract, policy, or court file beside the generated result.
If you see this risk, pause and get qualified help: Marking yes because a policy exists but staff cannot execute it.
The Nigeria Data Protection Act 2023 (NDPA) is Nigeria's comprehensive data protection legislation, replacing the earlier Nigeria Data Protection Regulation (NDPR) 2019. It establishes the Nigeria Data Protection Commission (NDPC) as the primary regulatory authority and introduces significantly stronger enforcement powers.
All organisations that process personal data of Nigerian residents must comply with the NDPA, regardless of whether the organisation is based in Nigeria or abroad. The Act applies to any processing of personal data where the data subject is in Nigeria or the processing relates to activities targeting Nigerian residents.
Non-compliance with the NDPA can result in administrative fines of up to ₦10,000,000 or 2% of annual gross revenue (whichever is higher), as well as criminal sanctions for individuals involved in serious breaches.