The Nigeria Data Protection Act – General Application and Implementation Directive (“GAID”) will become fully effective on 19 September 2025.

As shared in our earlier communication in March 2025, the GAID brought to an end the combined application of the Nigeria Data Protection Act (NDPA) 2023, Nigeria Data Protection Regulation (NDPR) 2019 and the NDPR Implementation Framework (NDPRIF) 2020, by repealing the NDPR, NDPRIF and replacing them with the GAID. The operative provisions for data protection in Nigeria are now the NDPA and the GAID.

The GAID provides practical guidance on the interpretation and implementation of the NDPA and explains areas such as: (a) the use of emerging technologies (artificial intelligence (AI), blockchain, and the Internet of Things (IoT)) for processing personal data; and (b) conducting Data Protection Impact Assessments (DPIAs), thereby offering organisations and individuals greater clarity on the application of the NDPA.

Given the replacement of the NDPR and NDPRIF with the GAID, organisations that had previously aligned their processes and policies with the NDPR and NDPRIF must now ensure that those processes and policies are updated to reflect the NDPA-GAID positions.

With the effective date fast approaching, we encourage you to review your current processes and ensure that your organisation is compliant. To assist you, we have prepared a newsletter (here) summarising the key provisions of the GAID.