NDPR Compliance: Navigating Nigeria's Data Protection Regulation
The Nigeria Data Protection Regulation (NDPR), issued by the National Information Technology Development Agency (NITDA) in January 2019, is Nigeria's primary data protection framework. Applicable to all natural persons in Nigeria and to organisations processing the personal data of Nigerian residents regardless of where the organisation is located, NDPR has created significant compliance obligations for Nigerian businesses, multinationals operating in Nigeria, and foreign companies with Nigerian customers or employees.
What NDPR Covers and Who It Applies To
NDPR applies to the processing of personal data of Nigerian citizens and residents — whether the processing is done inside or outside Nigeria. An e-commerce business in Europe with Nigerian customers, a US tech company with Nigerian employees, and a Nigerian bank processing customer data are all within scope.
Key definitions:
Personal data: Any information relating to an identified or identifiable natural person. Includes names, addresses, email addresses, phone numbers, biometric data, location data, health data, and financial information.
Data controller: Natural or legal persons that determine the purposes and means of personal data processing.
Data processor: Persons or organisations that process personal data on behalf of and under the authority of a data controller.
Sensitive personal data: Genetic data, biometric data, health data, racial or ethnic origin, political opinions, religious beliefs, and sexual orientation — subject to heightened protection requirements.
NDPR Key Requirements
Lawful basis for processing: Personal data may only be processed on a valid legal basis — consent, contractual necessity, legal obligation, vital interests, public interest, or legitimate interests.
Notice and transparency: Data subjects must be informed before collection of who is collecting their data, the purpose, the categories of data, who data will be shared with, and their rights.
Data subject rights: NDPR grants rights to access, rectification, erasure, restriction, portability, objection, and rights against automated decision-making — largely mirroring GDPR.
Data localisation (limited): NDPR requires that transfers of personal data outside Nigeria are subject to safeguards — the receiving country must have adequate data protection or a data transfer agreement must be in place.
Data breach notification: Data breaches must be reported to NITDA within 72 hours of becoming aware.
DPIA requirement: A Data Protection Impact Assessment is required before high-risk processing activities.
Mandatory annual audit: Organisations that process the personal data of more than 2,000 data subjects in a 12-month period must conduct an annual data protection audit and submit an audit report to NITDA. The audit must be conducted by a NITDA-licensed Data Protection Compliance Organisation (DPCO).
DPCO engagement: The annual audit requirement means Nigerian organisations and multinationals with significant Nigerian data processing must engage a licensed DPCO — making this a practically distinct compliance obligation from GDPR, which does not mandate external audit.
The NDPR Annual Audit: What It Involves
The mandatory NDPR annual audit, conducted by a NITDA-licensed DPCO, covers:
- Assessment of the organisation's data protection policies and procedures against NDPR requirements
- Review of processing activities and data flows
- Assessment of lawful bases for key processing activities
- Review of data subject rights procedures and records
- Assessment of data security measures
- Review of third-party data sharing and transfer mechanisms
- Assessment of data breach detection and notification procedures
- Review of employee data protection awareness and training
- Assessment of any cross-border data transfer mechanisms
The audit results in a compliance report submitted to NITDA. Organisations with significant non-compliance findings face regulatory action and reputational consequences.
NDPR and GDPR: Operating Both Simultaneously
Many international organisations must satisfy both NDPR and GDPR. The good news is that the two frameworks share substantial DNA — similar principles, similar rights, similar controller/processor distinction. A well-structured data protection programme can satisfy both by:
Unified Records of Processing Activities (ROPA): A single ROPA documenting all processing activities, lawful bases, data subject categories, retention periods, and transfer mechanisms — with both GDPR and NDPR compliance notes where they diverge.
Combined privacy notices: Privacy notices that satisfy both GDPR and NDPR transparency requirements, with jurisdiction-specific variations where needed.
Dual breach notification procedures: Procedures that satisfy the 72-hour notification requirement of both regulators simultaneously.
Nigerian-specific elements: The NDPR annual audit requirement is unique. Engaging a NITDA-licensed DPCO for this obligation and ensuring the engagement is documented and reported is specifically a Nigerian compliance obligation with no GDPR parallel.
Why Organisations Choose Savadub
Deep GRC Expertise
Our team holds practitioner-level expertise across every major compliance framework — not just theoretical knowledge, but hands-on implementation experience across multiple industries and organisation sizes.
Engineers, Not Just Consultants
We implement controls, not just recommend them. Our GRC engineers configure the systems, write the integrations, and build the monitoring pipelines that make compliance operational.
Global and African Regulatory Coverage
We understand both the global frameworks and the African regulatory environment — NDPR, NDPA, CBN directives, NITDA guidelines, and regional data protection laws — making us uniquely positioned for organisations operating across Africa and internationally.
Internal and External Audit Capability
We provide both embedded internal audit functions and independent third-party audit support, including CPA-accredited audit coordination for SOC examinations.
End-to-End Engagement
From initial gap assessment through certification, continuous monitoring, and ongoing compliance management — we are your long-term GRC partner, not a one-time consultant.
Industries We Serve
Financial Services · Healthcare · Technology & SaaS · Manufacturing · Logistics & Trade · Government & Public Sector · Energy & Critical Infrastructure · Education & EdTech · Media & Broadcasting · Retail & E-Commerce · Professional Services · Food & Beverage
Deliverables You Receive
Working with Savadub, every engagement delivers a concrete set of outputs:
- Gap Assessment Report — prioritised findings with effort estimates and risk ratings
- Compliance Roadmap — milestone-based plan from current state to certification or attestation
- Risk Register — organisational risk register with treatment plans
- Policy Pack — all required policies authored, reviewed, and approved
- Technical Control Implementation Evidence — configurations, screenshots, and audit trails
- Internal Audit Report — independent assessment of control effectiveness
- Audit Evidence Repository — organised, auditor-ready evidence collection
- Executive Summary Presentation — board and leadership-ready compliance status
- Remediation Tracker — structured tracking of open findings and closure evidence
- Continuous Monitoring Setup — ongoing CCM pipeline for post-certification compliance
Get Started with Savadub
Savadub's GRC practice combines deep compliance expertise with technical engineering capability. We don't just advise — we build, implement, and operate your compliance program from the ground up.
Book a free GRC consultation with our team. We will review your current posture, identify your most critical gaps, and give you a clear, costed roadmap to compliance.
Contact us:
- Email: grc@savadub.com
- Phone: +234 816 734 2201
- WhatsApp: +234 903 234 8435
- Website: www.savadub.com
