Find out your classification
Whether you are a “data controller or processor of major importance” and must register with the NDPC (GAID Articles 7–9).
For international companies
Doing business in Nigeria?
The Nigeria Data Protection Act applies to you.
The NDPA covers controllers and processors not domiciled in Nigeria that process personal data of people in Nigeria (NDPA s.2(2)(c); GAID Article 1) — an extraterritorial reach that follows the data, not the address. If you serve customers or staff in Nigeria, this is your work, and we handle it as a registered Nigerian DPCO.
Who it applies to
No Nigerian office required.
This page covers Nigeria data protection compliance for foreign companies: registration, cross-border transfers and the annual return. The Act follows the data, not the address, so NDPA compliance applies to international companies even with no Nigerian subsidiary. If you need help with NDPC registration as a foreign company, or with a cross-border data transfer out of Nigeria, that is the work below.
Sources: NDPA s.2(2)(c); GAID Article 1 — linked at the foot of this page.
What you may need to do
Four things to check.
Put a lawful basis in place
A lawful basis for sending Nigerians’ data abroad (NDPA Part VIII, cross-border transfers).
File the annual return
File the Compliance Audit Return through a licensed DPCO if you are in the UHL or EHL tier (due 31 March).
Appoint a DPO
Appoint a Data Protection Officer and keep your privacy notice current.
Why it matters
Enforcement is real.
The NDPC fined MultiChoice Nigeria ₦766.2 million in July 2025 for unlawful cross-border transfer of personal data.
How we help
Nigeria compliance,
handled for you.
Every engagement starts with a short consultation. We confirm scope, deliverables and timing in writing before any work begins.
Questions
Before you engage.
Does the NDPA apply to my company if we have no Nigerian office?
Yes. The NDPA covers controllers and processors not domiciled in Nigeria that process personal data of people in Nigeria (NDPA s.2(2)(c); GAID Article 1). It follows the data, not the address, so a company with no Nigerian office can still be in scope.
Do we need to register with the NDPC?
It depends on your processing — we assess this. Registration applies to data controllers and processors of major importance (GAID Articles 7–9). Whether your organisation meets that threshold depends on your sector and the volume and nature of the personal data you process.
Can we transfer Nigerians' data to our home country?
Cross-border transfers need a lawful basis under NDPA Part VIII. The NDPC has enforced this: it fined MultiChoice Nigeria ₦766.2 million in July 2025 for an unlawful cross-border transfer of personal data. What your transfer requires depends on your processing — we assess this.
Who can file our Compliance Audit Return?
The annual Compliance Audit Return is filed through a licensed Data Protection Compliance Organisation (DPCO), and it is due each year by 31 March. Supreme is a registered DPCO and can prepare and file the return on your behalf.
Can you act as our Data Protection Officer for Nigeria?
Yes. We provide DPO-as-a-service for Nigeria: a named DPO contact, policy and register maintenance, and support with data-subject requests, incidents and the annual return.
Go to the source
Official and reference sources.
Operationalising the NDPA through the GAID ↗
IAPP analysis of the Nigeria Data Protection Act and the General Application and Implementation Directive.
NDP Act 2023 & GAID 2025: a comprehensive guide ↗
LawPavilion guide to Nigeria’s data-protection landscape.
NDP Act & GAID 2025 (NDPC) ↗
The official directive text, published by the Commission.
NDPC fines MultiChoice ₦766m ↗
Vanguard report on the July 2025 enforcement decision on cross-border transfer.
Last reviewed: 11 October 2026 · Confirm current requirements with the official NDPC sources linked above.
Next step
Start with a consultation.
A short, fixed-scope call to confirm whether the NDPA applies to you and what it requires.