The General Application and Implementation Directive (GAID) 2025, issued by the Nigeria Data Protection Commission (NDPC) under the Nigeria Data Protection Act 2023, takes effect today, setting out detailed requirements for how organisations must implement the Act.
Key points
- Provides detailed guidance on lawful bases, consent, data subject rights and privacy notices.
- Clarifies the classification and registration of ‘data controllers and processors of major importance’.
- Sets expectations for annual compliance audit returns filed with the NDPC.
- Expands on data protection impact assessments, security measures and breach management.
- Replaces the earlier Nigeria Data Protection Regulation 2019 implementation framework.
For UK organisations processing Nigerian personal data, the GAID turns the high-level principles of the NDPA into specific, auditable obligations. Registration status, DPO appointments and audit filing deadlines should now be reviewed against the directive.
Source: NDPA General Application and Implementation Directive 2025 (Nigeria Data Protection Commission)
Need help understanding what this change means for your organisation? Get in touch for a pragmatic, no-obligation conversation.
