{ "jurisdiction_id": "NG", "jurisdiction": "Nigeria", "url": "https://dataprotection.gi/jurisdictions/nigeria/", "generator": "render_jid v13-gdpri-1.0.0", "date_modified": "2026-09-28", "schema_version": "gdpri-v2", "counts": { "categories": 10, "claims": 45, "claim_placements": 45, "sub_modules": 57, "source_register": 25 }, "categories": [ { "code": "regulator_and_framework", "name": "Regulator & Framework", "traffic_light": "amber", "sub_modules": [ "act_and_instruments", "material_scope", "regulator_and_authority", "regulator_registration_and_filing", "territorial_scope" ], "url": "https://dataprotection.gi/jurisdictions/nigeria/#regulator-and-framework-regulator-framework", "traffic_light_rationale": "Core statute and implementing directive are in force and actively enforced (registration, DPIA review, fines), but several operational details (e.g., full subsidiary regulations, sectoral harmonisation) remain under active development, consistent with the JID's in_transition designation.", "claims": [ { "statement": "The NDPA established the Nigeria Data Protection Commission whose mandate is to oversee implementation of the NDP Act.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "NDPC", "source_url": "https://ndpc.gov.ng/about-us/", "source_tier": null, "observed_at": "2026-08-07" }, { "statement": "The Federal Government of Nigeria signed the Nigeria Data Protection Act 2023 into law on 12 June 2023.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "NDPC", "source_url": "https://ndpc.gov.ng/about-us/", "source_tier": null, "observed_at": "2026-08-07" }, { "statement": "The NDPC published the General Application and Implementation Directive (GAID) of the NDPA in March 2025, which took effect 19 September 2025 and expressly replaced the Nigeria Data Protection Regulation 2019.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/from-principles-to-practice-operationalizing-nigerias-data-protection-act-through-the-gaid", "source_tier": null, "observed_at": "2026-08-07" }, { "statement": "The NDP Act covers all sectors and all aspects of data privacy, imposing a duty of care in respect of customers, employees, guests, visitors, and other data subjects.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "NDPC", "source_url": "https://ndpc.gov.ng/faqs/", "source_tier": null, "observed_at": "2026-08-07" }, { "statement": "The NDP Act applies where the organisation is domiciled, resident, or operating in Nigeria, where processing occurs within Nigeria, or where a non-domiciled organisation processes personal data of a data subject in Nigeria.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "NDPC", "source_url": "https://ndpc.gov.ng/faqs/", "source_tier": null, "observed_at": "2026-08-07" }, { "statement": "Data controllers and data processors of major importance (DCPMI) must register with the NDPC, classified into Ultra-High, Extra-High and Ordinary-High Level tiers with corresponding registration fees.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "NDPC", "source_url": "https://ndpc.gov.ng/wp-content/uploads/2025/07/Updated-Guidance-Notice-on-Registtration-2024.pdf", "source_tier": null, "observed_at": "2026-08-07" } ] }, { "code": "lawful_processing_and_special_data", "name": "Lawful Processing & Special Data", "traffic_light": "amber", "sub_modules": [ "consent_thresholds", "lawful_bases", "pseudonymisation_and_anonymisation", "special_categories" ], "url": "https://dataprotection.gi/jurisdictions/nigeria/#lawful-processing-and-special-data-lawful-processing-special-data", "traffic_light_rationale": "Core lawful-basis and consent framework is in force, but detailed sub-regulatory guidance on special categories, pseudonymisation/anonymisation safe-harbours and precise child-consent mechanics is not yet confirmed as published.", "claims": [ { "statement": "NDPC relies on and recognises lawful bases for data processing such as consent, legal obligation and contract, consistent with NDPA Part V provisions on lawful basis of personal data processing.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "NDPC", "source_url": "https://ndpc.gov.ng/", "source_tier": null, "observed_at": "2026-08-07" }, { "statement": "A data controller must seek consent either in writing, orally, through electronic means or by any other action through which the data subject knows he is giving consent.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "NDPC", "source_url": "https://ndpc.gov.ng/faqs/", "source_tier": null, "observed_at": "2026-08-07" }, { "statement": "A data controller or processor that deploys software for processing sensitive personal data must carry out a DPIA and submit it to the Commission within four months, per GAID Article 28(8).", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "NDPC", "source_url": "https://ndpc.gov.ng/wp-content/uploads/2025/07/NDP-ACT-GAID-2025-MARCH-20TH.pdf", "source_tier": null, "observed_at": "2026-08-07" }, { "statement": "No confirmed statutory or GAID-level pseudonymisation/anonymisation safe-harbour definitions were identified for NG in this research pass.", "regulatory_stage": null, "is_binding": false, "confidence": "Uncertain", "source_publisher": "NDPC", "source_url": "https://ndpc.gov.ng/wp-content/uploads/2025/07/NDP-ACT-GAID-2025-MARCH-20TH.pdf", "source_tier": null, "observed_at": "2026-08-07" } ] }, { "code": "data_subject_rights", "name": "Data Subject Rights", "traffic_light": "amber", "sub_modules": [ "access_right", "data_portability", "deadlines_and_response_windows", "rectification_and_erasure", "restriction_and_objection" ], "url": "https://dataprotection.gi/jurisdictions/nigeria/#data-subject-rights-data-subject-rights", "traffic_light_rationale": "Rights are enumerated and in force, but response-window deadlines are not confirmed from available sources.", "claims": [ { "statement": "Part VI of the NDPA (Section 34) sets out the general rights of a data subject, including withdrawal of consent under Section 35.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "National Assembly / hosted via DataGuidance", "source_url": "https://www.dataguidance.com/sites/default/files/nigeria_data_protection_establishment_etc._bill_2023.pdf", "source_tier": null, "observed_at": "2026-08-07" }, { "statement": "Section 36 of the NDPA provides data subjects a right to object to processing.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "National Assembly / hosted via DataGuidance", "source_url": "https://www.dataguidance.com/sites/default/files/nigeria_data_protection_establishment_etc._bill_2023.pdf", "source_tier": null, "observed_at": "2026-08-07" }, { "statement": "Section 38 of the NDPA provides for a data portability right, alongside Section 37's provisions on automated decision making.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "National Assembly / hosted via DataGuidance", "source_url": "https://www.dataguidance.com/sites/default/files/nigeria_data_protection_establishment_etc._bill_2023.pdf", "source_tier": null, "observed_at": "2026-08-07" }, { "statement": "No confirmed statutory deadline for controller response to data subject rights requests was located in the sources reviewed for NG.", "regulatory_stage": null, "is_binding": false, "confidence": "Uncertain", "source_publisher": "NDPC", "source_url": "https://ndpc.gov.ng/wp-content/uploads/2025/07/NDP-ACT-GAID-2025-MARCH-20TH.pdf", "source_tier": null, "observed_at": "2026-08-07" } ] }, { "code": "controller_processor_duties", "name": "Controller/Processor Duties", "traffic_light": "green", "sub_modules": [ "accountability_and_dpia", "breach_notification", "dpo_requirements", "joint_controller_arrangements", "retention_and_disposal", "ropa_requirements", "security_measures" ], "url": "https://dataprotection.gi/jurisdictions/nigeria/#controller-processor-duties-controller-processor-duties", "traffic_light_rationale": "Core accountability, DPIA, DPO, breach-notification and audit-filing obligations are confirmed in force and actively administered via NDPC's registration and DPCO ecosystem.", "claims": [ { "statement": "A data controller or data processor who deploys software for processing of sensitive personal data must carry out a DPIA and submit same to the Commission within four months, per GAID Article 28(8).", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "NDPC", "source_url": "https://ndpc.gov.ng/wp-content/uploads/2025/07/NDP-ACT-GAID-2025-MARCH-20TH.pdf", "source_tier": null, "observed_at": "2026-08-07" }, { "statement": "Section 32 of the NDPA (Part V) provides for the appointment of Data Protection Officers, with GAID requiring DPO reports to include the compliance status of the data controller or processor.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "NDPC", "source_url": "https://ndpc.gov.ng/wp-content/uploads/2025/07/NDP-ACT-GAID-2025-MARCH-20TH.pdf", "source_tier": null, "observed_at": "2026-08-07" }, { "statement": "Under Section 29(1)(a) of the NDPA, where a data controller or processor engages another processor, it must ensure the engaged processor complies with the principles and obligations applicable to the controller.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "NDPC", "source_url": "https://ndpc.gov.ng/wp-content/uploads/2025/07/Updated-Guidance-Notice-on-Registtration-2024.pdf", "source_tier": null, "observed_at": "2026-08-07" }, { "statement": "Where an offence has been committed by a body corporate or firm, principal officers are deemed culpable unless they prove the offence occurred without their consent/connivance and they exercised diligence to prevent it; controllers/processors are vicariously liable for acts of agents or employees.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "National Assembly / hosted via DataGuidance", "source_url": "https://www.dataguidance.com/sites/default/files/nigeria_data_protection_establishment_etc._bill_2023.pdf", "source_tier": null, "observed_at": "2026-08-07" }, { "statement": "Part VII of the NDPA (Section 39, 'Security, integrity, and confidentiality') establishes security-of-processing obligations for controllers and processors.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "National Assembly / hosted via DataGuidance", "source_url": "https://www.dataguidance.com/sites/default/files/nigeria_data_protection_establishment_etc._bill_2023.pdf", "source_tier": null, "observed_at": "2026-08-07" }, { "statement": "A data controller shall, within 72 hours of becoming aware of a breach likely to result in a risk to the rights and freedoms of individuals, notify the Commission of the breach, describing its nature including categories and approximate numbers of data subjects and records concerned.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "NDPC", "source_url": "https://ndpc.gov.ng/wp-content/uploads/2025/07/NDP-ACT-GAID-2025-MARCH-20TH.pdf", "source_tier": null, "observed_at": "2026-08-07" }, { "statement": "Where a breach occurs with respect to data being processed by a data processor, the processor shall, on becoming aware of the breach, notify the engaging data controller/processor describing the nature of the breach and respond to information requests.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "OneTrust DataGuidance", "source_url": "https://www.dataguidance.com/sites/default/files/data_protection_act_2023.pdf", "source_tier": null, "observed_at": "2026-08-07" }, { "statement": "Data controllers are expected to file annual Compliance Audit Returns (CAR) before 31 March each year, per GAID Articles 10.7 and 10.8, as a practical accountability/record-keeping mechanism.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "NDPC", "source_url": "https://ndpc.gov.ng/2025/03/20/", "source_tier": null, "observed_at": "2026-08-07" }, { "statement": "No confirmed statutory retention-period or disposal-duty provision was located for NG in this research pass.", "regulatory_stage": null, "is_binding": false, "confidence": "Uncertain", "source_publisher": "NDPC", "source_url": "https://ndpc.gov.ng/wp-content/uploads/2025/07/NDP-ACT-GAID-2025-MARCH-20TH.pdf", "source_tier": null, "observed_at": "2026-08-07" } ] }, { "code": "cross_border_and_adequacy", "name": "Cross-Border & Adequacy", "traffic_light": "amber", "sub_modules": [ "adequacy_granted", "adequacy_received", "data_localisation", "sccs_and_bcrs", "transfer_impact_assessment", "transfer_mechanisms" ], "url": "https://dataprotection.gi/jurisdictions/nigeria/#cross-border-and-adequacy-cross-border-adequacy", "traffic_light_rationale": "Statutory transfer mechanism and adequacy-assessment framework are in force, but the practical adequacy list, SCC/BCR forms, and any localisation mandate remain unconfirmed/undeveloped from available sources.", "claims": [ { "statement": "Sections 41-43 (Part VIII) of the NDP Act address the transfer of personal data to a foreign country, requiring an adequate level of protection be ensured by the controller or processor.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "NDPC", "source_url": "https://ndpc.gov.ng/wp-content/uploads/2025/07/Updated-Guidance-Notice-on-Registtration-2024.pdf", "source_tier": null, "observed_at": "2026-08-07" }, { "statement": "A data controller or processor must submit a Cross-Border Data Transfer Instrument to the Commission for approval and obtain that approval before engaging in cross-border data transfer.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "NDPC", "source_url": "https://ndpc.gov.ng/faqs/", "source_tier": null, "observed_at": "2026-08-07" }, { "statement": "A level of protection is deemed adequate under Section 42 of the NDPA if it upholds principles substantially similar to the conditions for processing personal data under the Act.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "OneTrust DataGuidance", "source_url": "https://www.dataguidance.com/sites/default/files/data_protection_act_2023.pdf", "source_tier": null, "observed_at": "2026-08-07" } ] }, { "code": "sectoral_watch", "name": "Sectoral Watch", "traffic_light": "amber", "sub_modules": [ "credit_and_scoring", "education", "employment_data", "financial_sector_overlay", "health_sector_overlay", "insurance", "telecoms_and_eprivacy" ], "url": "https://dataprotection.gi/jurisdictions/nigeria/#sectoral-watch-sectoral-watch", "traffic_light_rationale": "Financial and telecoms sector overlays are confirmed and actively enforced; health, education, credit-scoring and insurance sector overlays are unconfirmed from available sources.", "claims": [ { "statement": "NDPC recognises the Central Bank of Nigeria's Consumer Protection Regulation (Article 5.4) as a complementary instrument alongside the NDPA.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "NDPC", "source_url": "https://ndpc.gov.ng/about-us/", "source_tier": null, "observed_at": "2026-08-07" }, { "statement": "The Central Bank of Nigeria issued a risk-based cybersecurity framework and guidelines for other financial institutions on 29 June 2022, covering cybersecurity oversight, risk management and reporting.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "OneTrust DataGuidance", "source_url": "https://www.dataguidance.com/news/nigeria-cbn-issues-risk-based-cybersecurity-framework", "source_tier": null, "observed_at": "2026-08-07" }, { "statement": "NDPC fined Fidelity Bank NGN 555.8 million for data protection violations, evidencing active enforcement against financial-sector data controllers.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "OneTrust DataGuidance", "source_url": "https://www.dataguidance.com/news/nigeria-ndpc-fines-fidelity-bank-ngn-5558m-data", "source_tier": null, "observed_at": "2026-08-07" }, { "statement": "NDPC recognises Part IV of the Nigerian Communications Commission's Consumer Code of Practice Regulations as a complementary instrument to the NDPA.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "NDPC", "source_url": "https://ndpc.gov.ng/about-us/", "source_tier": null, "observed_at": "2026-08-07" } ] }, { "code": "adtech_and_commercial_privacy", "name": "AdTech & Commercial Privacy", "traffic_light": "red", "sub_modules": [ "clean_rooms_and_dcr", "cookies_and_trackers", "cross_context_advertising", "dark_patterns", "direct_marketing", "opt_out_signals" ], "url": "https://dataprotection.gi/jurisdictions/nigeria/#adtech-and-commercial-privacy-adtech-commercial-privacy", "traffic_light_rationale": "No dedicated adtech/commercial-privacy instrument (cookies, dark patterns, opt-out signals, clean rooms, direct marketing) was confirmed for NG beyond general NDPA consent principles.", "claims": [ { "statement": "No confirmed NG-specific statutory cookie/tracker consent regime distinct from general NDPA consent principles was located in this research pass.", "regulatory_stage": null, "is_binding": false, "confidence": "Uncertain", "source_publisher": "NDPC", "source_url": "https://ndpc.gov.ng/wp-content/uploads/2025/07/NDP-ACT-GAID-2025-MARCH-20TH.pdf", "source_tier": null, "observed_at": "2026-08-07" } ] }, { "code": "algorithmic_biometric_and_surveillance_governance", "name": "Algorithmic, Biometric & Surveillance Governance", "traffic_light": "amber", "sub_modules": [ "ai_risk_assessments", "automated_decision_making_transparency", "biometric_regime", "genetic_data", "profiling_restrictions", "state_surveillance_carveouts" ], "url": "https://dataprotection.gi/jurisdictions/nigeria/#algorithmic-biometric-and-surveillance-governance-algorithmic-biometric-surveill", "traffic_light_rationale": "Automated decision-making right is confirmed in force; biometric, genetic, AI-risk-assessment and surveillance-carveout specifics remain largely unconfirmed or emergent.", "claims": [ { "statement": "Section 37 of the NDPA (Part VI) provides for protections in relation to automated decision-making.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "National Assembly / hosted via DataGuidance", "source_url": "https://www.dataguidance.com/sites/default/files/nigeria_data_protection_establishment_etc._bill_2023.pdf", "source_tier": null, "observed_at": "2026-08-07" }, { "statement": "NDPC has partnered with Lagos Business School to establish a National Artificial Intelligence Scaling Hub, signalling emergent AI-governance engagement not yet codified as a binding risk-assessment requirement.", "regulatory_stage": null, "is_binding": false, "confidence": "Speculative", "source_publisher": "NDPC", "source_url": "https://ndpc.gov.ng/", "source_tier": null, "observed_at": "2026-08-07" }, { "statement": "The GAID clarifies that nothing in the NDP Act or GAID authorises data processing without compliance with Sections 37 and 45 of the 1999 Constitution of the Federal Republic of Nigeria.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "NDPC", "source_url": "https://ndpc.gov.ng/wp-content/uploads/2025/07/NDP-ACT-GAID-2025-MARCH-20TH.pdf", "source_tier": null, "observed_at": "2026-08-07" } ] }, { "code": "children_and_vulnerable_groups", "name": "Children & Vulnerable Groups", "traffic_light": "amber", "sub_modules": [ "age_verification", "dependent_adults", "education_settings", "minor_profiling_bans", "parental_consent" ], "url": "https://dataprotection.gi/jurisdictions/nigeria/#children-and-vulnerable-groups-children-vulnerable-groups", "traffic_light_rationale": "Section 31 confirms a children/incapacitated-persons category exists in force, but implementation specifics (age threshold, parental consent mechanics, profiling bans) remain unconfirmed.", "claims": [ { "statement": "Section 31 of the NDPA (Part V) addresses processing of data belonging to children or persons lacking the legal capacity to consent, establishing a distinct consent-capacity category under the Act.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "National Assembly / hosted via DataGuidance", "source_url": "https://www.dataguidance.com/sites/default/files/nigeria_data_protection_establishment_etc._bill_2023.pdf", "source_tier": null, "observed_at": "2026-08-07" }, { "statement": "No confirmed minimum-age threshold or age-verification mechanism under the NDPA/GAID was located in this research pass.", "regulatory_stage": null, "is_binding": false, "confidence": "Uncertain", "source_publisher": "National Assembly / hosted via DataGuidance", "source_url": "https://www.dataguidance.com/sites/default/files/nigeria_data_protection_establishment_etc._bill_2023.pdf", "source_tier": null, "observed_at": "2026-08-07" } ] }, { "code": "enforcement_and_redress", "name": "Enforcement & Redress", "traffic_light": "green", "sub_modules": [ "collective_redress_and_class_actions", "enforcement_activity_index", "private_right_of_action", "recent_developments_180d", "regulator_funding_and_capacity", "regulator_powers_and_penalties" ], "url": "https://dataprotection.gi/jurisdictions/nigeria/#enforcement-and-redress-enforcement-redress", "traffic_light_rationale": "Enforcement powers are clearly codified and actively exercised, with multiple significant fines and ongoing investigations within the recent evidence window, plus judicial affirmation of NDPC's regulatory powers.", "claims": [ { "statement": "A data subject aggrieved by a controller/processor's decision, action or inaction in violation of the NDPA may lodge a complaint with the Commission, which may also investigate on its own accord under Section 46.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "OneTrust DataGuidance", "source_url": "https://www.dataguidance.com/sites/default/files/data_protection_act_2023.pdf", "source_tier": null, "observed_at": "2026-08-07" }, { "statement": "Under Section 47, the Commission may make a compliance order against a data controller or processor it is satisfied has violated or is likely to violate the NDPA or subsidiary legislation.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "OneTrust DataGuidance", "source_url": "https://www.dataguidance.com/sites/default/files/data_protection_act_2023.pdf", "source_tier": null, "observed_at": "2026-08-07" }, { "statement": "Under Section 48, a penalty or remedial fee for a DCPMI may reach the 'higher maximum amount' (the greater of NGN10,000,000 and 2% of annual gross revenue), while a non-major controller/processor faces a 'standard maximum amount' (the greater of NGN2,000,000 and 2% of annual gross revenue).", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "NDPC", "source_url": "https://ndpc.gov.ng/faqs/", "source_tier": null, "observed_at": "2026-08-07" }, { "statement": "NDPC fined Fidelity Bank NGN 555.8 million for data protection violations.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "OneTrust DataGuidance", "source_url": "https://www.dataguidance.com/news/nigeria-ndpc-fines-fidelity-bank-ngn-5558m-data", "source_tier": null, "observed_at": "2026-08-07" }, { "statement": "NDPC fined MultiChoice Nigeria NGN 766 million for unlawful data transfers and privacy rights violations.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "OneTrust DataGuidance", "source_url": "https://www.dataguidance.com/news/nigeria-ndpc-fines-multichoice-nigeria-ngn-766m", "source_tier": null, "observed_at": "2026-08-07" }, { "statement": "NDPC has commenced a sector-by-sector investigation of compliance with the NDPA and is investigating an alleged data breach at the Corporate Affairs Commission (CAC).", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "OneTrust DataGuidance", "source_url": "https://www.dataguidance.com/news/nigeria-ndpc-investigates-alleged-data-breach-cac", "source_tier": null, "observed_at": "2026-08-07" }, { "statement": "Data subjects have the right to file civil actions in court against a data controller or data processor on the basis of the NDP Act.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "NDPC", "source_url": "https://ndpc.gov.ng/faqs/", "source_tier": null, "observed_at": "2026-08-07" }, { "statement": "NDPC is reported to be investigating an alleged data breach at the Corporate Affairs Commission (CAC), a development reported in April 2026, within the 180-day recent-developments window of this run.", "regulatory_stage": null, "is_binding": false, "confidence": "Probable", "source_publisher": "OneTrust DataGuidance", "source_url": "https://www.dataguidance.com/news/nigeria-ndpc-investigates-alleged-data-breach-cac", "source_tier": null, "observed_at": "2026-08-07" }, { "statement": "A Nigerian court reportedly backed NDPC's power to require registration of Data Controllers/Processors of Major Importance (DCPMIs), reinforcing the Commission's registration and enforcement authority.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "NDPC", "source_url": "https://ndpc.gov.ng/resources/", "source_tier": null, "observed_at": "2026-08-07" } ] } ] }