The Nigeria Data Protection Act 2023: What It Means for Your Website and Apps

This article is general information, not legal advice. For decisions about your organisation, consult the Act, guidance from the Nigeria Data Protection Commission, and a qualified lawyer.

The Nigeria Data Protection Act 2023 (NDPA) was signed into law on 12 June 2023. It is Nigeria's first data protection statute and it established the Nigeria Data Protection Commission (NDPC) to oversee compliance. If your website, app or business collects names, phone numbers, email addresses, location, payment details or any other information about identifiable people, the Act very likely applies to you.

The principles

Section 24 of the Act sets out principles that should guide all processing of personal data. In summary, personal data must be:

• processed lawfully, fairly and transparently;
• collected for specified, legitimate purposes and not used in ways incompatible with them;
• adequate, relevant and limited to what is necessary (data minimisation);
• accurate and kept up to date;
• kept no longer than necessary; and
• protected with appropriate security against loss, misuse or unauthorised access.

You need a lawful basis

Section 25 provides six lawful bases for processing: the person's consent; performance of a contract with them; compliance with a legal obligation; protecting someone's vital interests; a task in the public interest or under official authority; and the legitimate interests of the organisation, provided they are not overridden by the person's rights. Choose the right basis for each purpose before you collect the data, and record why.

People's rights

Individuals have rights over their data, including the rights to access it, have it corrected or deleted, restrict or object to certain processing, receive it in a portable format, and withdraw consent at any time. Your website or app needs a simple way for people to make these requests, and a process for answering them.

Data breaches: the 72-hour rule

Under section 40, if a breach is likely to result in a risk to people's rights and freedoms, the data controller must notify the NDPC within 72 hours of becoming aware of it. Where the risk to individuals is high, the affected people must also be told. Information can be provided in phases if not everything is known within 72 hours.

Data controllers and processors "of major importance"

Organisations that process personal data of particular value or significance to Nigeria's economy, society or security are classed as data controllers or processors "of major importance". They must register with the NDPC and designate a data protection officer. In March 2025 the Commission issued the General Application and Implementation Directive (GAID 2025), which gives more operational detail on how the Act is applied, including registration, so check the current guidance to see whether this applies to you.

A practical checklist for websites and apps

1. Map your data: what you collect, where it is stored, who can access it and which vendors process it for you.
2. Collect less: remove form fields you do not genuinely need.
3. Publish a clear privacy notice explaining what you collect, why, the lawful basis, how long you keep it and how people can exercise their rights.
4. Get proper consent where consent is your basis, such as for marketing messages, and make withdrawing it as easy as giving it.
5. Secure it: HTTPS everywhere, multi-factor authentication for admin accounts, access on a need-to-know basis, encrypted backups.
6. Review vendor contracts with hosting, email and analytics providers, and check the Act's rules before transferring personal data outside Nigeria.
7. Prepare a breach response plan so you can meet the 72-hour deadline.
8. Set retention periods and delete data you no longer need.

Further reading

• Nigeria Data Protection Commission