Nigeria's Data Protection Act: a website checklist

A website with a contact form, newsletter sign-up, analytics, checkout or login collects personal data. If it serves people in Nigeria, the Nigeria Data Protection Act 2023 (NDPA) applies, and since September 2025 a detailed directive explains how the regulator expects you to comply.

This checklist covers what the law means for a typical business website. It is written for owners and managers, not lawyers.

Not legal advice. This article is general information about the law as we understand it in October 2026. For decisions about your organisation, speak to a qualified data protection lawyer or a licensed Data Protection Compliance Organisation.

The rules in brief

• The Act. The Nigeria Data Protection Act 2023 was signed into law on 12 June 2023. It created the Nigeria Data Protection Commission (NDPC) as the regulator.
• The directive. The NDPC issued the General Application and Implementation Directive (GAID) 2025 on 20 March 2025. It took effect on 19 September 2025. From that date, the older Nigeria Data Protection Regulation 2019 and its implementation framework stopped applying as regulatory instruments.
• Who it covers. Organisations in Nigeria, and organisations outside Nigeria that process the data of people in Nigeria, for example by offering them goods or services.

The website checklist

1. Know what data your site collects

List every point where personal data enters: forms, sign-ups, checkout, chat widgets, analytics, advertising pixels, embedded videos and maps, and other third-party scripts. For each, note the purpose, where the data goes and how long you keep it.

2. Publish a proper privacy policy

Section 27 of the Act says that before you collect personal data you must tell people, in a privacy policy written in clear and accessible language:

• who you are and how to contact you;
• the lawful basis and the purpose of the processing;
• who receives the data, if anyone;
• their rights under the Act;
• how long you keep the data;
• their right to complain to the Commission;
• whether you use automated decision-making, including profiling.

A policy copied from another site will not match your list from step 1. Write yours from your own data map.

3. Get consent right where you rely on it

Under section 26, consent must be an affirmative act and cannot rely on a pre-ticked box. The request must be in clear, simple language, and people must be told they can withdraw consent before they give it. Withdrawal does not make earlier processing unlawful.

On a website this means unticked boxes for marketing emails, separate tick boxes for separate purposes, and a working unsubscribe link.

Not everything needs consent. Answering an enquiry someone sent you, or fulfilling an order, can rely on other lawful bases such as contract. Choose the basis that fits and state it in your privacy policy.

4. Fix your cookie banner

Article 19 of the GAID deals with cookies. According to the law firm summaries we reviewed, the banner must be prominent and visible without the visitor having to scroll; strictly necessary cookies do not need consent, but other cookies (analytics, advertising, social media) need an explicit choice to accept or reject; and you must explain the purpose of each cookie, who sets it and how to withdraw consent.

In practice:

• give "Reject" the same prominence as "Accept";
• do not load analytics or advertising scripts until the visitor has accepted;
• keep a cookie notice that lists what each cookie does;
• let visitors change their choice later, for example from a footer link.

5. Protect children

Section 31 requires parental or guardian consent where you rely on consent for a child, and an appropriate way to verify age. If your site or app is aimed at young people, design this in from the start.

6. Assess high-risk processing

Section 28 requires a data privacy impact assessment before processing that is likely to pose a high risk to people's rights, such as large-scale processing of sensitive data, tracking, or new technology. If the assessment shows a high risk you cannot reduce, you must consult the Commission before going ahead.

7. Secure the site and plan for breaches

Section 39 expects appropriate technical and organisational measures, such as encryption, pseudonymisation, tested backups and regular security testing. For a website, that means HTTPS everywhere, patched software, strong admin authentication and limited access to form submissions and databases.

If a breach does happen, section 40 sets the timetable:

• a data processor (for example your hosting or email provider) must tell you when it becomes aware of a breach;
• you must notify the NDPC within 72 hours of becoming aware of a breach likely to pose a risk to people's rights and freedoms;
• where the risk is high, you must tell the affected people immediately, in plain language, including what they can do to protect themselves;
• you must keep a record of every breach, its effects and what you did about it.

Seventy-two hours goes quickly, so agree who decides and who drafts the notices in advance.

8. Check where your data travels

Most websites send data abroad without anyone deciding to: hosting in Europe, email marketing in the United States, analytics wherever the vendor runs it. Part VIII of the Act restricts transfers out of Nigeria unless the destination offers adequate protection, through an adequacy decision, binding corporate rules, contractual clauses or similar instruments. Without adequacy, section 43 allows transfers in limited cases, such as informed consent to the risks or where the transfer is necessary to perform a contract with the person.

Ask each supplier where data is stored and what transfer terms they offer, and record the answer.

9. Work out whether you are "of major importance"

The Act creates a category of data controllers and processors of major importance, organisations that process large volumes of data or data of particular value. They must register with the NDPC (section 44) and tell the Commission about significant changes within 60 days. The GAID sorts them into three tiers: Ultra-High, Extra-High and Ordinary-High Level.

Under the GAID, organisations in the Ultra-High and Extra-High tiers must file an annual Compliance Audit Return (CAR), and a licensed Data Protection Compliance Organisation (DPCO) can carry out the audit and file it for them. For 2025 returns, the deadline was 31 March 2026, later extended by the NDPC to 30 May 2026. Late filing attracts a penalty of 50% of the filing fee. Organisations of major importance must also have a Data Protection Officer; the GAID describes the role and asks the DPO to produce a report every six months.

Many small businesses will not fall into these tiers, but check rather than assume.

10. Know the stakes

Section 48 lets the Commission order remedies, compensation and penalties. The maximum penalty is the greater of ₦10 million or 2% of the previous year's annual gross revenue for an organisation of major importance, and the greater of ₦2 million or 2% for others.

Serving Nigeria and the UK or EU

Many of our clients serve customers in both Nigeria and Britain or Europe. The good news is that the laws share a lot of DNA. A site built properly for one is most of the way there for the others.

One difference worth knowing: since 5 February 2026, UK rules (changed by the Data (Use and Access) Act 2025) allow some cookies used only for statistical analytics, or to remember how a site looks, to be set without consent, provided you explain them clearly and let people opt out. Nigeria's GAID has no equivalent exemption in the summaries we reviewed, so a site serving both countries should still ask Nigerian visitors before loading analytics. The simplest approach is to apply the stricter rule to everyone.

Where we come in

Most of this checklist comes down to how a website is built: which scripts load and when, how forms store data and where the hosting is. When we build or rebuild a site, we map the data, set up consent properly, keep tracking off until it is accepted and document the suppliers involved, so your lawyer or DPCO has something solid to review.

If you want your current site checked against this list, get in touch. See also our cyber security and web development services.

Sources

1. KPMG Nigeria: President signs the Nigerian Data Protection Bill 2023 into law
2. PLAC: Nigeria Data Protection Act 2023 (full text)
3. Aluko & Oyebode: NDPC GAID takes effect on 19 September
4. Mondaq (Adeola Oyinlade & Co): Key regulatory updates under the GAID 2025
5. Mondaq: Nigeria data privacy law 2025, NDPA and GAID guide
6. Mondaq (Pavestones Legal): NDPC extends data audit filing deadline
7. ICO: Personal data breaches, a guide
8. GDPR Article 33: Notification of a breach to the supervisory authority
9. GDPR Article 34: Communication of a breach to the data subject
10. GDPR Article 83: General conditions for imposing fines
11. Stevens & Bolton: The DUAA and cookies, what is changing
12. Blake Morgan: Data (Use and Access) Act 2025, cookies