XcellComply|Nigeria Data Protection Act (NDPA) 2023

The three tiers of data controllers and processors of major importance in GAID Schedule 7. Ultra-High Level covers listed sectors such as commercial banks, telcos, insurers and fintechs, or more than 5,000 data subjects in six months (₦250,000 registration fee). Extra-High Level covers 1,000–4,999 data subjects or listed bodies such as MDAs and microfinance banks (₦100,000). Ordinary-High Level covers 200–999 data subjects or listed bodies such as schools (₦10,000).

By 31 March each year, for the previous year's processing, filed by UHL and EHL entities through an NDPC-licensed DPCO on the NDPC portal. Entities set up after 12 June 2023 file their first return within 15 months. Late filing adds up to 50% to the filing fee. For 2025 returns, the NDPC extended the deadline to 30 May 2026.

No. XcellHost is not an NDPC-licensed Data Protection Compliance Organisation. We prepare you — gap assessment, evidence pack, DPO, DPIAs and remediation — and the Compliance Audit Return is filed through an NDPC-licensed DPCO partner*. You keep the relationship with the NDPC.

Under s.40, a controller notifies the NDPC within 72 hours of becoming aware of a breach likely to risk people's rights and freedoms, and tells data subjects immediately where the risk is high. A processor notifies its controller. Separately, cyber threats go to ngCERT within 72 hours under the amended Cybercrimes Act, and CBN-regulated banks report incidents to the CBN within 24 hours.

Only with a recorded transfer basis. Sections 41–43 allow transfers where the destination is adequate — by law, binding corporate rules, contractual clauses, a code or a certification — or a s.43 basis such as informed consent or contract necessity applies. The GAID adds a DPIA for cross-border transfers. We found no NDPC adequacy decision for India, so most transfers rely on contractual clauses or BCRs. Government and citizen data may need to stay in Nigeria under NITDA's cloud policy; we use partner data centres in Nigeria* where it must.

Section 64 of the Act kept NDPR-era instruments in effect until replaced. The GAID, issued 20 March 2025, says the NDPC stops applying the NDPR 2019 and its 2020 implementation framework; actions already taken under them stay valid. Today the Act and the GAID are the working rulebook.

Under s.48, the NDPC can order remedies, compensation and penalties. The cap is the greater of ₦10 million or 2% of the previous year's annual gross revenue for controllers and processors of major importance, and the greater of ₦2 million or 2% for others. Ignoring a compliance order is an offence (s.49), and data subjects can sue for damages (s.51).

Controllers of major importance must designate one (s.32). The DPO can be an employee or a contractor with expert knowledge. The GAID adds publishing contact details, sending them to the NDPC, semi-annual reports and annual certification. Our vDPO service covers this.

A lot of the work is shared: data maps, notices, consent records, rights workflows, security and breach runbooks. The deadlines and filings differ — the NDPA has 72-hour NDPC notice, NDPC registration tiers and annual audit returns. We run one privacy programme with a Nigeria layer on our privacy management platform.

No. Prices marked * are placeholders, indicative only. Other services use the exact prices on their linked XcellHost pages. Prices are in INR excl. 18% GST for Indian billing; for a Nigerian entity, VAT or withholding tax may apply instead. NDPC and DPCO fees are extra. USD or naira quotes on request.