Nigeria

The Nigeria Data Protection Act 2023 applies where the organisation is based, resident or operating in Nigeria, where the processing happens in Nigeria, or where an organisation with no Nigerian presence at all processes the data of a person in Nigeria. The Commission's 2025 Directive spells out that 'operating in Nigeria' includes simply targeting people in Nigeria. The registration threshold is unusually low: an organisation handling the data of more than 200 people within any six months, or working in one of thirteen listed sectors including finance, health, education, communications, insurance, oil and gas, hospitality and e-commerce, is treated as being 'of major importance' and must register. The Act also protects Nigerian citizens who are outside Nigeria, though in that case the organisation's duties are limited to what mutual legal assistance arrangements cover.

Sector overrides, most restrictive first. PAYMENTS: every domestic card, cash machine and point-of-sale transaction must be switched by a Nigerian switch and, in the central bank's words, must not 'under any circumstance' be routed outside Nigeria. BANKING AND OTHER REGULATED FINANCE: the central bank issued a circular on 15 June 2026 headed 'Introduction of Market Structure Requirements, Data Localisation, Ultimate Beneficial Ownership Disclosure, and Systemic Oversight Measures in the Nigeria Payments System', and from 1 January 2027 the technology agency's cloud rules say all financial data generated, processed, transmitted or stored by regulated financial institutions must be primarily hosted, processed and stored inside Nigeria. TELECOMS: no subscriber information may be moved out of Nigeria without the telecoms regulator's prior written consent, and phone companies may not copy or store subscriber records for any purpose beyond what the rules allow. GOVERNMENT AND CRITICAL DATA: from 2027 government and regulated sector data at classification Level 2 and above must be hosted in Nigeria by default, with both the live site and the backup site inside the country, and the most sensitive class may never leave a Nigerian government facility. SECURITIES: the markets regulator does not impose storage in Nigeria, but a digital asset business must have a Nigerian office and must justify to the regulator any function it outsources abroad. HEALTH: no health specific storage rule was found on a federal health domain, checked 18 August 2026; health records sit at Level 2 of the cloud classification, where hosting in Nigeria is described as highly recommended rather than mandatory.

Section 41 of the Act allows a transfer where the recipient is covered by a law, binding corporate rules, contractual clauses, a code of conduct or a certification that gives adequate protection. Section 42 lets the Commission declare a country, region, sector or set of standard clauses adequate, and section 42(6) states that the absence of such a decision does not imply adequacy. As of 18 August 2026 no adequacy decision could be found on the Commission's own site, in the 2025 Directive or in the Commission's 2025 annual report, so the list is empty and the burden sits entirely with the organisation. Schedule 5 of the 2025 Directive describes the grounds as an adequacy decision, a Cross-Border Data Transfer Instrument approved by the Commission, or 'other lawful bases', and says that instrument route covers codes of conduct, certifications, binding corporate rules and standard contractual clauses. The Commission's 2025 annual report goes further, listing 'Unauthorised Cross-Border Transfer of Personal Data' as a live enforcement theme and saying some controllers 'seem oblivious of their obligations in seeking the approval of the Commission before carrying out cross-border transfer'. Treat approval as expected in practice even though the statute reads as self-assessment. You must also record the basis for every transfer, and answer for it in your annual audit filing, which asks which countries you send data to.

Enforcement is rated active rather than aggressive on the Commission's own description of its approach: the 2025 annual report says it has 'adopted a restorative rather than punitive approach', leaning on warnings, compliance orders and 'remedial fees in lieu of strict penalties' under section 48(2)(d) of the Act. The numbers it publishes for itself are investigations of 117 in 2022, 177 in 2023, 213 in 2024 and 146 in 2025; compliance revenue of 94.4 million naira in 2022 rising to 4.99 billion naira in 2025; registered organisations of major importance of 36,052 in 2024 and 38,661 in 2025; and 306 licensed Data Protection Compliance Organisations. Open investigations span health, social media, telecommunications, banking and financial technology, and hospitality, and named recurring problems include opening bank accounts without consent, copied and pasted privacy notices, cookie-based data mining and unauthorised cross-border transfers. The report also says the Commission is 'now transitioning into a phase of full enforcement'. The chief executive is Dr Vincent Olatunji, National Commissioner, who signed the 2025 Directive and appears in Commission news through August 2026.

The six month default in Article 49(3) of the 2025 Directive is the single most easily missed rule in Nigeria, because most global retention schedules assume that silence means you may keep data indefinitely. Article 49(4) softens it: you may keep data longer with proper safeguards to defend a legal claim or for due diligence. On the floor side: the central bank's open banking rules require data obtained for open banking to be kept for a minimum of seven years, and a security annex in the same document says open banking data must be retained for reference for a minimum of ten years, so the same instrument contains two different minimums. Telecoms business rules require evidence and logs of subscriber consent to be stored for at least two years and biometric verification logs for at least two years. Intercepted communications held by security agencies may be archived for three years and then must be destroyed. Compliance timing: an organisation must run a data protection audit within fifteen months of starting business and every year afterwards, and an organisation of major importance in the top two tiers must file its audit return by 31 March each year, with a late fee of half the filing fee. General company and tax record floors were not verified from government sources on this run.

The duty sits in section 40 of the Act and is expanded in Article 33 of the 2025 Directive. The Directive adds a duty of care overlay: whatever the 72 hour limit says, you must give immediate information to all relevant authorities, including the Commission, where that could help contain a breach on a national or sector scale. It also lists eight things the notification must contain, including when the breach happened, how many people are at real risk of significant harm, and a named contact who can answer the Commission's questions. Reports are filed through the Commission's online breach portal. Watch for extra sector clocks: banks, payment firms and telecoms operators sit under their own incident reporting rules, and those deadlines were not verified from primary regulator documents on this run because the central bank blocks automated downloads of its circulars.

(1) The 200 person threshold in Schedule 7 of the 2025 Directive is far below the level most companies expect, and thirteen listed sectors are caught regardless of size. Registration fees run from 10,000 naira to 250,000 naira, and the annual audit return fee runs up to 1,000,000 naira, about 735 US dollars, for the largest filers, with a 50 percent surcharge for filing late. (2) 'Child' takes its meaning from the Child's Rights Act 2003, so the age is 18, not 13 or 16, and the Act says presenting a government approved identity document is an acceptable way to check age. (3) The six month default deletion rule in Article 49(3) applies wherever no other law sets a period. (4) Section 49 makes failure to comply with an enforcement order a criminal offence carrying up to one year in prison, and section 53 deems the principal officers of a company culpable unless they prove the offence happened without their consent or connivance and that they exercised diligence. (5) Under Article 10(14) of the Directive, organisations in the top two tiers must file their audit returns through a Data Protection Compliance Organisation licensed by the Commission, so an in-house team cannot simply file for itself. A sixth to watch: the Commission's own reading is that cross-border transfers need its approval, which is stricter than the plain words of the Act.

Dated items. 1 January 2027: the National Cloud Computing Guideline 2026 and the National Cloud Technical Guideline 2026, both approved on 4 August 2026 and both marked mandatory, are stated to take effect, subject to a transition period for existing deployments that the technology agency has yet to publish. 15 June 2026: the central bank's payments system circular on market structure and data localisation was issued, with its practical deadlines unverified because the bank blocks public downloads of the file. Dormant switches, any of which can move without a public consultation. (1) Section 41(4) of the Act lets the Commission designate categories of personal data that get extra transfer restrictions, and none has been designated yet. (2) The 2025 Directive says a dedicated cross-border transfer instrument is still to be issued, and Article 50 lets the Commission issue supplementary rules that override the Directive. (3) The cloud guideline says it commences 'on such date as may be determined by NITDA', despite the 1 January 2027 date in its own front matter, so the start date is at the agency's discretion. (4) The telecoms regulator holds a draft Data Protection Regulations 2023 and a draft Internet Code of Practice that remain drafts with no legal effect. (5) The technology agency can grant temporary localisation waivers to foreign cloud providers that promise investment in Nigerian data centres, which makes the localisation wall negotiable for large players and not for small ones.