Loading
Loading
We use strictly necessary cookies to run this site, and analytics cookies to understand how it's used. See our Privacy Policy for details.
Nigeria's Data Protection Act, 2023 (NDPA) requires notifying the NDPC within 72 hours of becoming aware of a risk-bearing breach, and imposes tiered fines, up to the greater of ₦10,000,000 or 2% of annual gross revenue for controllers/processors of major importance.
Content reviewed 2026-09-08 , informational, not legal advice. Confirm current requirements with the authority linked below or your own counsel.
Nigeria's principal data protection statute, signed into law 12 June 2023. Establishes the Nigeria Data Protection Commission (NDPC), sets out principles and lawful bases for processing, data subject rights, data security and breach obligations (Part VII), registration for controllers/processors 'of major importance' (Part IX), and enforcement powers (Part X).
Source72 hours
Under Section 40(2), a data controller must, within 72 hours of becoming aware of a breach likely to result in a risk to the rights and freedoms of individuals, notify the NDPC. Under Section 40(3), where a breach is likely to result in a high risk, the controller must immediately communicate the breach to affected data subjects in plain, clear language.
Notify: Nigeria Data Protection Commission (NDPC)
SourcePublished legal maximums, not a personalized estimate, not legal advice.
Nigeria Data Protection Act, 2023, Remedial Fee / Penalty (Sections 48-49)
Controllers/processors 'of major importance': up to the greater of ₦10,000,000 or 2% of annual gross revenue for the preceding financial year. Controllers/processors NOT of major importance: up to the greater of ₦2,000,000 or 2% of annual gross revenue
This two-tier structure (Section 48(3)-(5)) applies to NDPC-ordered remedial fees for any violation, and the same figures apply again as the criminal fine under Section 49 for failing to comply with an NDPC compliance order, which can additionally carry imprisonment of up to one year.
SourceNot applicable , as of 2026-09-08
72 hours from becoming aware of a breach likely to pose a risk to individuals' rights and freedoms, under Section 40(2) of the NDPA.
The NDPA distinguishes controllers/processors 'of major importance' from those that are not. Major-importance entities face fines up to the greater of ₦10,000,000 or 2% of annual gross revenue; other entities face fines up to the greater of ₦2,000,000 or 2% of annual gross revenue.
Yes. Under Section 49, failing to comply with an NDPC compliance order is an offence carrying a fine (at the applicable tier) and/or imprisonment for up to one year.
Talk to us about scoping an engagement around your specific regulatory context.
