Nigeria

Tier 2 Comprehensive law Africa

Principal framework: Nigeria Data Protection Act (2023). Regulator: NDPC. The NDPA 2023 replaced the NDPR framework; the NDPC licenses compliance organisations (DPCOs) and issued its GAID implementation directive in 2025.

At a glance

Principal law: Nigeria Data Protection Act, 2023 (Act No. 37 of 2023)
Regulator: Nigeria Data Protection Commission (NDPC)
Breach notification: 72 hours to the NDPC for qualifying breaches; subjects where high risk
Maximum penalty: Higher of ₦10m or 2% of annual gross revenue for major controllers
DPO required: Required for data controllers of major importance
Digital consent age: Under 18 — parental consent
Extraterritorial reach: Yes — targeting Nigerian data subjects

Structure

Structural pattern: Not assessed
Sub-jurisdictions: None — no sub-national axis
ISO code: NG

A Pattern 4 jurisdiction has no sub-national layer to model. Devolution elsewhere in the legal system does not imply it here — check each Act rather than reasoning from the country.

Transfers and adequacy

EU member: No
EEA member: No

Instruments

No instrument profiled yet.

Sources

Primary Nigeria Data Protection Act, 2023 (Act No. 37 of 2023)
Regulator NDPC — regulator and NDPA text

Never independently verified — seeded from the prototype.