Introduction
In March 2025, the Nigeria Data Protection Commission (NDPC) issued the General Application and Implementation Directive (GAID) 2025, providing structured guidance on the implementation of the Nigeria Data Protection Act (NDPA) 2023. The GAID clarifies regulatory obligations for data controllers and processors, offering practical frameworks to strengthen compliance within and outside Nigeria.
Key Highlights of the GAID
- Lawful Processing and Privacy by Design: Data processing must be based on lawful grounds such as consent, contract, legal obligation, public interest, or legitimate interest. Privacy by Design is emphasised, requiring Data Protection Impact Assessments (DPIAs) for sensitive data activities and emerging technologies.
- Categorisation and Tiered Compliance for Data Controllers and Processors: Organisations classified as data controllers or processors of major importance must register with the NDPC. The GAID categorises them into Ultra-High Level (UHL), Extra-High Level (EHL), and Ordinary-High Level (OHL) tiers, each with escalating compliance obligations, including annual audit returns, and mandatory training.
- Cross-Border Data Transfers: The GAID introduces specific safeguards for transferring personal data abroad, including adequacy decisions (where a foreign jurisdiction provides sufficient data protection), standard contractual clauses, and approved transfer mechanisms.
- Mandatory Data Breach Notification: Data breaches must be reported to the NDPC within 72 hours, and affected individuals must be notified promptly. The GAID prescribes the minimum content requirements for breach notifications and remediation measures.
- Standard Notice to Address Grievances (SNAG): Data subjects now have a formalised tool—SNAG—to demand internal redress from data controllers before escalating complaints to the NDPC.
- Embedding Data Ethics: Organisations are expected to incorporate data ethics into operational policies, addressing transparency, fairness, informational autonomy, and outcome assessment. Formal documentation of data ownership and ethical intent is encouraged.
What This Means For Stakeholders
- Data Controllers: Data controllers remain subject to heightened compliance obligations. They must ensure lawful data processing, conduct mandatory Data Protection Impact Assessments (DPIAs) where required, oversee third-party processors effectively, and integrate ethical data practices into their operations. Non-compliance could attract regulatory scrutiny and significant financial penalties.
- Data Processors: Data processors must comply with stricter obligations under formal Data Processing Agreements (DPAs). Failure to meet these obligations may result in direct regulatory action.
- Businesses: Businesses across sectors should prepare for increased compliance costs, operational changes, and heightened legal risks.
- Individuals (Data Subjects): Data subjects enjoy strengthened rights, including the ability to access, rectify, erase, and transfer their personal data. Enforcement tools, such as the Standard Notice to Address Grievance (SNAG), provide clearer and faster pathways for individuals to seek redress when their data privacy rights are infringed.
Stay Ahead with SimmonsCooper Partners
GAID 2025 provides structured guidance on the implementation of the NDPA 2023, setting clear compliance expectations for data controllers, processors, and businesses across sectors. For expert advice on aligning your operations with Nigeria’s evolving data protection framework, contact us at info@scp-law.com or visit www.scp-law.com.
