Nigeria

The Nigeria Data Protection Act 2023 applies in three cases. First, where you are based, resident or operating in Nigeria. Second, where the data is handled in Nigeria. Third, where an organisation with no Nigerian presence at all handles the data of a person in Nigeria. The Commission's 2025 Directive says 'operating in Nigeria' includes simply targeting people in Nigeria. The registration threshold is unusually low. You count as an organisation 'of major importance' if you handle the data of more than 200 people within any six months. You also count if you work in one of thirteen listed sectors. Those include finance, health, education, communications, insurance, oil and gas, hospitality and e-commerce. If you count, you must register. The Act also protects Nigerian citizens who are outside Nigeria. In that case your duties go only as far as mutual legal assistance arrangements cover.

Industry overrides, strictest first. PAYMENTS: every domestic card, cash machine and point-of-sale transaction must be switched by a Nigerian switch. In the central bank's words, it must not 'under any circumstance' be routed outside Nigeria. BANKING AND OTHER REGULATED FINANCE: the central bank issued a circular on 15 June 2026 on market structure, keeping data in Nigeria, beneficial ownership disclosure and oversight of the Nigeria Payments System. From 1 January 2027 the technology agency's cloud rules say all financial data created, handled, sent or stored by regulated financial institutions must be mainly hosted and stored inside Nigeria. TELECOMS: no subscriber information may leave Nigeria without the telecoms regulator's prior written consent. Phone companies may not copy or store subscriber records for any purpose beyond what the rules allow. GOVERNMENT AND CRITICAL DATA: from 2027, government and regulated sector data at classification Level 2 and above must be hosted in Nigeria by default. Both the live site and the backup site must be inside the country. The most sensitive class may never leave a Nigerian government facility. SECURITIES: the markets regulator does not require storage in Nigeria. But a digital asset business must have a Nigerian office, and must justify to the regulator any work it outsources abroad. HEALTH: we found no health-specific storage rule on a federal health site, checked 18 August 2026. Health records sit at Level 2 of the cloud classification, where hosting in Nigeria is described as highly recommended rather than compulsory.

Section 41 of the Act allows a transfer where the recipient is covered by a law, group-wide rules, contract clauses, a code of conduct or a certification that gives adequate protection. Section 42 lets the Commission declare a country, region, sector or set of standard clauses safe enough. Section 42(6) says that the absence of such a decision does not mean a destination is safe. As of 18 August 2026 we found no such decision on the Commission's own site, in the 2025 Directive or in the Commission's 2025 annual report. So the list is empty and the burden sits entirely with you. Schedule 5 of the 2025 Directive lists the grounds as an official decision that a country is safe enough, a cross-border transfer document approved by the Commission, or 'other lawful bases'. It says the approved-document route covers codes of conduct, certifications, group-wide rules and standard contract clauses. The Commission's 2025 annual report goes further. It lists unauthorised cross-border transfer of personal data as a live enforcement theme. It says some organisations seem unaware that they must get the Commission's approval before sending data abroad. So expect to need approval, even though the Act reads as though you assess it yourself. You must also record the basis for every transfer, and answer for it in your annual audit filing, which asks which countries you send data to.

Enforcement is rated active rather than aggressive on the Commission's own description of its approach: the 2025 annual report says it has 'adopted a restorative rather than punitive approach', leaning on warnings, compliance orders and 'remedial fees in lieu of strict penalties' under section 48(2)(d) of the Act. The numbers it publishes for itself are investigations of 117 in 2022, 177 in 2023, 213 in 2024 and 146 in 2025; compliance revenue of 94.4 million naira in 2022 rising to 4.99 billion naira in 2025; registered organisations of major importance of 36,052 in 2024 and 38,661 in 2025; and 306 licensed Data Protection Compliance Organisations. Open investigations span health, social media, telecommunications, banking and financial technology, and hospitality, and named recurring problems include opening bank accounts without consent, copied and pasted privacy notices, cookie-based data mining and unauthorised cross-border transfers. The report also says the Commission is 'now transitioning into a phase of full enforcement'. The chief executive is Dr Vincent Olatunji, National Commissioner, who signed the 2025 Directive and appears in Commission news through August 2026.

The six month default in Article 49(3) of the 2025 Directive is the rule people miss most often in Nigeria. Most global retention schedules assume that silence means you may keep data forever. Article 49(4) softens it. You may keep data longer, with proper safeguards, to defend a legal claim or for due diligence. On the keep side: the central bank's open banking rules require data obtained for open banking to be kept for a minimum of seven years. A security annex in the same rules says open banking data must be kept for reference for a minimum of ten years. So one document sets two different minimums. Telecoms business rules require evidence and logs of subscriber consent to be stored for at least two years, and biometric verification logs for at least two years. Intercepted communications held by security agencies may be archived for three years and must then be destroyed. Timing: you must run a data protection audit within fifteen months of starting business, and every year afterwards. An organisation of major importance in the top two tiers must file its audit return by 31 March each year, with a late fee of half the filing fee. We could not verify the general company and tax record retention periods from government sources.

The duty sits in section 40 of the Act and is expanded in Article 33 of the 2025 Directive. The Directive adds a duty of care overlay: whatever the 72 hour limit says, you must give immediate information to all relevant authorities, including the Commission, where that could help contain a breach on a national or sector scale. It also lists eight things the notification must contain, including when the breach happened, how many people are at real risk of significant harm, and a named contact who can answer the Commission's questions. Reports are filed through the Commission's online breach portal. Watch for extra sector clocks: banks, payment firms and telecoms operators sit under their own incident reporting rules, and those deadlines were not verified from primary regulator documents on this run because the central bank blocks automated downloads of its circulars.

(1) The 200 person threshold in Schedule 7 of the 2025 Directive is far below the level most companies expect, and thirteen listed sectors are caught regardless of size. Registration fees run from 10,000 naira to 250,000 naira, and the annual audit return fee runs up to 1,000,000 naira, about 735 US dollars, for the largest filers, with a 50 percent surcharge for filing late. (2) 'Child' takes its meaning from the Child's Rights Act 2003, so the age is 18, not 13 or 16, and the Act says presenting a government approved identity document is an acceptable way to check age. (3) The six month default deletion rule in Article 49(3) applies wherever no other law sets a period. (4) Section 49 makes failure to comply with an enforcement order a criminal offence carrying up to one year in prison, and section 53 deems the principal officers of a company culpable unless they prove the offence happened without their consent or connivance and that they exercised diligence. (5) Under Article 10(14) of the Directive, organisations in the top two tiers must file their audit returns through a Data Protection Compliance Organisation licensed by the Commission, so an in-house team cannot simply file for itself. A sixth to watch: the Commission's own reading is that cross-border transfers need its approval, which is stricter than the plain words of the Act.

Dated items. 1 January 2027: the National Cloud Computing Guideline 2026 and the National Cloud Technical Guideline 2026 are stated to take effect. Both were approved on 4 August 2026 and both are marked mandatory. There is a transition period for existing deployments, which the technology agency has yet to publish. 15 June 2026: the central bank issued its payments system circular on market structure and keeping data in Nigeria. Its practical deadlines are unverified, because the bank blocks public downloads of the file. Powers already held, any of which can move without a public consultation. (1) Section 41(4) of the Act lets the Commission name types of personal data that get extra transfer restrictions. None has been named yet. (2) The 2025 Directive says a dedicated cross-border transfer document is still to be issued, and Article 50 lets the Commission make extra rules that override the Directive. (3) The cloud guideline says it starts 'on such date as may be determined by NITDA', despite the 1 January 2027 date on its own front pages. So the start date is at the agency's discretion. (4) The telecoms regulator holds a draft Data Protection Regulations 2023 and a draft Internet Code of Practice. Both are still drafts with no legal effect. (5) The technology agency can give foreign cloud providers temporary waivers from the rule that data stays in Nigeria, if they promise investment in Nigerian data centres. So the rule is negotiable for large players and not for small ones.