The General Application and Implementation Directive 2025 (GAID 2025) was issued under the Nigeria Data Protection Act, 2023 (the NDP Act). The Directive came into force on 20 March 2025 and became fully effective on 19 September 2025.
The purpose of the GAID is simple, it is to explain how the NDP Act should actually be applied in practice. It gives structure to compliance, especially at a time when technology is changing how people, businesses, and governments use personal data every day. At its core, it reinforces the right to privacy under Section 37 of the 1999 Constitution and supports the growth of a digital economy that people can trust.
Why the Nigeria Data Protection Act Matters
The NDP Act exists to protect people. It safeguards the rights and freedoms of individuals when their personal data is being processed and creates a proper legal framework for how organisations are expected to handle data of data subjects in Nigeria.
Objectives of the Act and GAID
The objective of the Act and GAID are as follows:
- To protect the fundamental rights of data subjects under the Constitution;
- To regulate how personal data is processed;
- To promote data security and privacy;
- To ensure that data is processed in a fair, lawful, and accountable manner;
- To provide remedies when data rights are breached;
- To hold data controllers and processors responsible for their obligations; and
- To establish an independent regulatory authority to supervise data protection and collection of personal data in Nigeria.
The Act also aims to strengthen Nigeria’s digital economy and ensure that personal data can be used in a beneficial and trusted way, both locally and internationally.
Where the Act Applies
The NDP Act applies to the processing of personal data whether done by automated systems or otherwise. It covers situations where:
- The data controller or processor is domiciled in, resident in, or operating in Nigeria;
- The processing takes place within Nigeria; or
- The organisation is outside Nigeria but processes or targets the personal data of people in Nigeria.
The GAID explains that even where a company is not physically present in Nigeria, it can still be subject to the Act and GAID if it processes the data of Nigerian data subjects. This makes it clear that data protection is not limited by borders.
Universality of Data Subject Rights
The GAID reflects the principle that a person’s fundamental rights does not disappear simply because of location. A data subject is entitled to protection of their rights anywhere in the world, subject only to constitutional limits and applicable international law.
Under Article 1 of the GAID, data subject rights apply to:
- Anyone within Nigeria, regardless of nationality or migration status;
- Anyone whose personal data has been transferred to Nigeria;
- Anyone whose data is merely in transit through Nigeria, in which case obligations are limited to confidentiality, integrity, and availability; and
- Nigerian citizens outside the country, the Commission is empowered to seek mutual legal assistance where necessary under international law.
This reinforces the idea that privacy is a fundamental right and not just a local compliance issue.
Core Compliance Obligations for Organisations
To comply with the NDP Act and GAID, data controllers and processors are expected to take practical and documented steps, including:
- Registering with the Nigeria Data Protection Commission as a data controller and processor of major importance;
- Carrying out a compliance audit within fifteen (15) months of starting business and annually thereafter;
- Filing Compliance Audit Returns (CAR) where required;
- Identifying all obligations under the Act and preparing clear compliance schedules;
- Preparing semi‑annual data protection reports and maintaining data security systems to ensure confidentiality, integrity, and availability;
- Training staff regularly and sensitising employees on data protection responsibilities;
- Appointing a Data Protection Officer (DPO);
- Developing and publishing a compliant privacy policy;
- Providing visible and meaningful privacy and cookie notices on websites;
- Carrying out Data Privacy Impact Assessments (DPIAs) where required;
- Reporting data breaches to the Commission within 72 hours and notifying affected data subjects where the risk is high;
- Updating third‑party agreements to reflect NDP Act obligations;
- Designing systems that allow data subjects to access, correct, and transfer their data easily; and
- Clearly explaining complaint procedures to data subjects, including the right to approach the Commission.
These requirements are meant to make data protection part of everyday business operations, not just paperwork.
Classification of Data Controllers and Processors of Major Importance
The GAID classifies major data controllers and processors based on scale and impact:
- Ultra‑High Level (UHL)
- Tier A: 50,000 data subjects and above
- Tier B: 25,000–49,999 data subjects
- Tier C: below 25,000 data subjects
- Extra‑High Level (EHL)
- Tier A: 10,000 data subjects and above
- Tier B: 5,000–2,500 data subjects
- Tier C: below 2,500 data subjects
- Ordinary‑High Level (OHL): Amount of data subject wasn’t specified by the commission.
Factors for Classification
UHL organisations are expected to meet global standards and typically qualify if at least four of the following apply:
- High sensitivity of personal data;
- Significant data-driven financial assets entrusted;
- Reliance on third-party servers or cloud services for substantial processing;
- Substantial involvement in cross-border data flows;
- Processing over 5,000 data subjects within six months;
- Requirement for international standard certifications for people, processes, and technologies.
EHL organisations meet global best practices and qualify if at least four of the following apply:
- High sensitivity of personal data;
- Significant financial assets entrusted;
- Functions as an establishment of government;
- Reliance on third-party servers for substantial processing;
- Involvement in cross-border data flows;
- Processing over 1,000 but less than 5,000 data subjects in six months;
- Requirement for reputable and standardised certifications.
OHL organisations typically qualify if at least four of the following apply:
- Sensitivity of data assets;
- Vulnerability of data subjects;
- High risk to privacy if processed systematically or automatically;
- Processing over 200 but less than 1,000 data subjects in six months;
- Need for adequate technical and organisational measures;
- Requirement for reputable and standardised certifications.
Fees Payable to the Commission for Audit Report
| DCPMI | Tier | Fee (N) |
| Ultra‑High Level (UHL) | 50,000 data subjects and above 25,000–49,999 data subjects below 25,000 data subjects | 1,000,000 750,000 500,000 |
| Extra‑High Level (EHL) | 10,000 and above data subjects 5,000–2,500 data subjects below 2,500 data subjects | 250,000 200,000 100,000 |
Specific Types of Data Controllers and Processors
- UHL (N250,000): Commercial banks, telecom companies, insurance companies, multinationals, electricity distribution companies, oil and gas companies, social media and email app developers, communication device manufacturers, payment gateway providers, fintechs, or any organisation processing over 5,000 data subjects in six months are all under the category.
- EHL (N100,000): MDAs, microfinance banks, tertiary/higher institutions, hospitals providing secondary/tertiary care, mortgage banks, or any organisation processing 1,000–5,000 data subjects in six months are all under the category.
- OHL (N10,000): Primary/secondary schools, corporate training providers, primary health centres, independent medical labs, hotels/guest houses with under 50 suites, or processors handling 200–1,000 sensitive data subjects commercially are all under the category.
Data Controllers that are Not of Major Importance
The following are a list of data controllers not of major importance by NDPC;
- Small traders or artisans who do not transmit personal data for business objectives;
- Traders with under 15 employees or artisans without structured filing systems, only routine contact information;
- Communities of friends, professionals, or groups interacting on social media.
Exemption of Establishments or Organisations that are Data Controllers and Data Processors of Major Importance
Under Section 44(6) of the NDP Act, the following are exempted from registration as a data controller and processor of major importance:
- Community-based associations;
- Faith-based organisations;
- Foreign embassies and high commissions;
- Judicial establishments or adjudicatory bodies;
- Multigovernmental organisations.
Registration as a Data Controller and Processor of Major Importance
UHL and EHL entities register once and file CAR annually. OHL entities renew registration annually but are not required to file CAR. Any significant change in registration information must be reported within 60 days. Organisations that no longer qualify may request removal but remain liable for outstanding fees. The Commission maintains a public register of all registered data controllers and processors.
Filing of NDP Act Compliance Audit Returns with the Commission
Article 10 of the GAID outlines audit and CAR requirements and it stipulates the following;
- Audits follow a risk-based approach considering people, processes, and technology;
- Controls must align with global best practices;
- Risk points are monitored at appropriate intervals;
- Online systems vulnerable to cyber threats are audited frequently;
- CAR is filed annually via the Commission’s portal;
- Late filing attracts a penalty of 50% of the fee payable to the commission;
- UHL/EHL CAR must be submitted through licensed DPCOs;
- The Commission may request further information and issue a Compliance Audit Returns Certificate.
The Designation of a Data Protection Officer (DPO)
The NDP Act and GAID place strong emphasis on the DPO and it stipulates the following:
- There must be a designated DPO by data controllers and processors of major importance;
- DPOs Can be an employee of the organisation or under a service contract;
- The contact details of the DPOs must be published and communicated to the Commission;
- The DPOs must be involved in all processing matters in respect to data subjects;
- Organisations must provide resources, access, and continuous training for their DPOs;
- DPOs must act independently without penalty for performing statutory duties;
- DPOs must reports directly to management;
- Data subjects may contact the DPOs;
- DPOs are bound by confidentiality and must avoid conflicts of interest;
- DPOs must have expert knowledge of data protection law and practice.
Credential Assessment of DPOs
Article 14 introduces formal oversight it stipulates that:
- The Commission maintains a database of certified DPOs meaning that all DPOs must be certified by NDPC;
- DPOs must undergo Annual Credential Assessment (ACA);
- DPOs must comply with the NDP Act, GAID, DPCO Code of Conduct, and professional ethics;
- Certification of DPOs is verified during CAR filing or registration;
- Verification may be declined if CPD evidence is unreliable;
- Verification fees may apply;
- Assessment ensures DPOs are fit to safeguard data subjects’ rights.
Conclusion
The GAID 2025 gives structure to Nigeria’s data protection framework. It explains how the NDP Act applies, how organisations are classified, what compliance looks like in practice, and how accountability is enforced through audits, registration, fees, exemptions, and the role of the DPO.
For any organisation processing personal data in or about Nigeria, the GAID is not optional. It is the standard for lawful, responsible, and trustworthy data use in Nigeria’s digital economy.
*********************************************************************************
About KORIAT & CO.
We are a commercial law firm in Nigeria with network of lawyers and consultants in Ghana, Kenya and Rwanda. The above article is not legal advice and does not automatically make our readers our clients unless they specifically instruct us to act or represent them in any way.
We assist local and foreign clients to process company registration and business licences in Nigeria, Ghana, Kenya and Rwanda.
Please contact Koriat & Co. through admin@koriatlaw.com or 09067842241 if you require additional information about or assistance in processing company incorporation or application for a money lender’s licence.
 2025.){kind=link}