NDPR
Nigeria Data Protection Regulation 2019 — National Information Technology Development Agency (NITDA)
Also known as: NDPR, Nigeria Data Protection Regulation, Nigeria DPR 2019
At a glance
- Status
- Superseded
- Next deadline
- None announced
- How it is assessed
- The NDPR required data controllers to audit their data protection practices and file annual audit summaries; the GAID now requires annual compliance audit returns from data controllers and processors of major importance. source
- Written by
- Issued by the National Information Technology Development Agency (NITDA) under the NITDA Act; data protection is now regulated by the Nigeria Data Protection Commission (NDPC) under the Nigeria Data Protection Act 2023. source source
- Enforced by
- The NDPR set fines of 2% of annual gross revenue or ₦10 million for controllers with more than 10,000 data subjects, and 1% or ₦2 million otherwise. source
- Last change
Nigeria's data protection regulation, issued by NITDA under the NITDA Act. It sets the lawful bases for processing personal data, the rights of data subjects, security and breach duties for data controllers, the annual data protection audit, and limits on transfers abroad. It has been superseded in practice by the Nigeria Data Protection Act and the General Application and Implementation Directive, under which the Nigeria Data Protection Commission no longer applies it as a legal instrument.
Recent changes
Nothing changed in the last 90 days. Sign in to read further back.
Key dates
No upcoming datesVersion history
-
Nigeria Data Protection Regulation 2019 Major versionCurrent
NITDA signed the Regulation on 25 January 2019. source
Who it applies to
The NDPR covered processing of personal data of people in Nigeria and of Nigerian citizens abroad; it has given way to the Nigeria Data Protection Act 2023 and the GAID 2025.
- Scope
- The Regulation applies to all transactions intended for processing personal data of natural persons in Nigeria, by whatever means (NDPR 1.2(a)). source
- Citizens abroad
- It also applies to natural persons residing in Nigeria or residing outside Nigeria who are citizens of Nigeria (NDPR 1.2(b)). source
- Replaced
- Upon issuing the GAID, the Commission ceased to apply the NDPR 2019 as a legal instrument for regulating data privacy and protection; this does not affect anything done under the NDPR before the GAID (GAID Article 3(3)). source
How compliance is assessed
The NDPR required data controllers to audit their data protection practices and file annual audit summaries; the GAID now requires annual compliance audit returns from data controllers and processors of major importance.
- NDPR audit filing
- A data controller that processed personal data of more than 2,000 data subjects in 12 months had to submit a summary of its data protection audit by 15 March of the following year (NDPR 4.1(7)). source
- GAID compliance returns
- Data controllers and processors of major importance file NDP Act Compliance Audit Returns (CAR) with the Commission annually, not later than 31 March for those established before 12 June 2023 (GAID Article 10). source
Enforcement and penalties
The NDPR set fines of 2% of annual gross revenue or ₦10 million for controllers with more than 10,000 data subjects, and 1% or ₦2 million otherwise.
2% of revenue or ₦10 million
NDPR 2.10(a), whichever is greater, for a data controller dealing with more than 10,000 data subjects. source
1% of revenue or ₦2 million
NDPR 2.10(b), whichever is greater, for a data controller dealing with fewer than 10,000 data subjects. source
- Status
- The Commission no longer applies the NDPR as a legal instrument; enforcement now runs under the Nigeria Data Protection Act 2023 (GAID Article 3). source
Documents
Frequently asked questions
Is the NDPR 2019 still in force?
No longer as the regulator's instrument: with the GAID 2025, the Nigeria Data Protection Commission ceased to apply the NDPR 2019 as a legal instrument, without affecting anything done under it before. source
Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 20 September 2026. Subscribe to NDPR (RSS)