Nigeria is Africa’s largest startup market and has an active data protection regulator. The Nigeria Data Protection Act 2023 created the Nigeria Data Protection Commission (NDPC), and the 2025 GAID replaced the old NDPR with detailed implementation rules.
Startups that qualify as data controllers or processors of major importance must register and file compliance audit returns. The GAID also requires assessments before deploying AI, blockchain or IoT.
- Core data law
- Nigeria Data Protection Act 2023
- Implementation
- GAID 2025, effective 19 Sep 2025
- Regulator
- Nigeria Data Protection Commission (NDPC)
- Registration
- Data controllers/processors of major importance
- Breach notice
- Within 72 hours to the NDPC
- Penalties
- Up to 2% of annual gross revenue or ₦10 million for major importance entities
Who needs to comply
Startups processing personal data of people in Nigeria
The NDPA applies to controllers and processors domiciled or operating in Nigeria, or processing data of people in Nigeria.
Fintech, telecoms, health and large consumer apps
These are likely to be ‘of major importance’ and must register and file audits.
AI, blockchain and IoT deployments
The GAID requires prior assessments for emerging technologies.
The laws, in detail
01Nigeria Data Protection Act 2023 & GAID 2025
Lawful bases, rights, DPOs, registration, audits, breach notification and transfers.
When it applies
Processing by entities in Nigeria or of data subjects in Nigeria.
What you must do
- Lawful basis and privacy notice
- Register with the NDPC if of major importance
- Appoint a DPO and file compliance audit returns
- Notify the NDPC of breaches within 72 hours
- DPIAs, including before deploying AI, blockchain or IoT
- Transfer safeguards for data leaving Nigeria
Regulator
NDPC
Penalties
Higher of ₦10 million or 2% of annual gross revenue for major importance entities; lower caps for others.
02Cybercrimes (Prohibition, Prevention, etc.) Act 2015 (amended 2024)
Cybercrime offences, incident reporting and data retention.
When it applies
Service providers and organisations operating computer systems in Nigeria.
What you must do
- Report cyber attacks and threats to ngCERT within the statutory deadline
- Retain traffic data as required
- Cooperate with lawful requests
Regulator
Office of the National Security Adviser; ngCERT
Penalties
Fines and imprisonment for offences and non-reporting.
03Investments and Securities Act 2025
Recognises digital assets as securities and brings VASPs under SEC regulation.
When it applies
Digital asset exchanges, issuers and other VASPs serving Nigeria.
What you must do
- SEC registration before operating
- Investor protection and disclosure rules
- AML/CFT compliance
Regulator
Securities and Exchange Commission Nigeria
Penalties
Fines and enforcement action.
04CBN rules for fintech and payments
Licensing of payment service banks, switches, processors and mobile money operators.
When it applies
Payments and fintech startups operating in Nigeria.
What you must do
- CBN licence for regulated payment activities
- Data localisation of certain payment data
- Consumer protection framework
Regulator
Central Bank of Nigeria
Penalties
Licence action and penalties.
05FCCPC digital lending rules
Registration and conduct rules for digital lenders.
When it applies
Digital, online and app-based lenders serving Nigerian consumers.
What you must do
- Register with the FCCPC
- Fair debt collection; no harassment or contact shaming
- Transparent pricing
Regulator
Federal Competition and Consumer Protection Commission
Penalties
Fines and delisting from app stores.
Compliance checklist
01 · Before you launch
- Privacy notice
- Check major importance thresholds and register
- Appoint a DPO
02 · At launch
- 72-hour breach process
- Transfer safeguards
- DPIA for AI or other emerging tech
03 · Every year
- File compliance audit returns
- Renew registration and fees
Key dates
- Jun 2023NDPA signed
- Mar 2025GAID issued
- 19 Sep 2025GAID effective; NDPR superseded
Common mistakes
- Missing compliance audit return deadlines
- Deploying AI without a prior assessment
FAQs
Do foreign startups need to register in Nigeria?
If they are data controllers or processors of major importance for Nigerian data subjects, registration may be required.
Sources
Reviewed 12 October 2026. General information, simplified for planning; not legal advice. Check current law before relying on any requirement, and get advice for your facts. For markets outside India, advice is coordinated with locally qualified counsel.