NDPA 2023 Compliance: Nigeria Data Protection Consultancy

Most Nigerian organisations processing personal data cannot answer three basic questions: what personal data do we hold, why do we hold it, and what is our lawful basis for processing it. The NDPA 2023 requires clear answers to all three. The NDPC can investigate, audit, and fine organisations up to 2% of annual gross revenue for failing to provide them.

The NDPA 2023 is not the NDPR with a new name. It introduces stronger obligations, a more powerful regulator, and detailed implementation requirements set out in the GAID 2025 that many organisations have not yet read. Applying a generic GDPR template to your Nigerian operations will not satisfy the NDPC.

For organisations operating in both Nigeria and the UK, running two separate compliance programmes for largely overlapping obligations wastes time and creates inconsistency. One misaligned privacy notice in one jurisdiction creates risk in both.

Enforcement is no longer theoretical. The NDPC has issued fines against organisations for data protection violations and opened compliance investigations into large numbers of companies at once. Organisations that treated the NDPA 2023 as a low-priority policy update are now reassessing that decision under regulatory pressure, which is a harder position to work from than starting the programme properly the first time.

A recurring failure point is the registration question. Many organisations do not know whether they qualify as a Data Controller of Major Importance, so they either register unnecessarily or miss an actual registration obligation. Both outcomes carry cost, one in wasted administrative effort, the other in regulatory exposure.

FortressPoint builds NDPA 2023 compliance programmes for organisations across Nigerian markets, and for international organisations with Nigerian operations. We start with a data inventory, mapping what personal data you hold, where it comes from, where it goes, and what you do with it.

From the inventory we assess your lawful basis for each processing activity, identify the gaps, and build the documentation and procedures to close them. We align the programme to the GAID 2025 requirements that sit alongside the Act itself, because most compliance programmes built on the Act alone are missing critical implementation detail.

For organisations with UK operations we build one programme that satisfies both UK GDPR and NDPA 2023. You do not run parallel compliance tracks for the same controls.

We assess your Data Controller of Major Importance status early in the engagement, because it determines your registration obligations and the depth of documentation the NDPC expects. Getting this classification right at the start avoids both unnecessary registration and the risk of missing a real one.

Where an organisation needs a Data Protection Officer and does not have one, we can act as your outsourced DPO or help you appoint and brief an internal one, so the role is properly defined from day one rather than added on as an afterthought once a compliance gap has already appeared.

We do not apply a UK GDPR framework with Nigerian labels. The NDPA 2023 differs from UK GDPR in specific ways that matter, particularly on cross-border transfers, retention obligations under GAID 2025, and the registration requirements for Data Controllers of Major Importance. We know the differences and we build for them.

For organisations in both markets we build one programme covering both regimes. Your privacy notices say the same thing in both jurisdictions, your breach procedures meet both timelines, and your data inventory covers both operations. No duplication.

We produce documentation the NDPC can review, not paperwork designed to look complete. Compliance programmes that look good internally but cannot withstand regulatory scrutiny are not compliance programmes.

We track how the NDPC is actually enforcing the Act, not just what the Act says on paper. Recent fines and investigations tell you what regulators are prioritising in practice, and we build programmes that address those priorities directly rather than treating every clause of the Act as equally urgent.