The Nigeria Data Protection Regulation (NDPR) has been on the books since 2019. For most of its first four years, NITDA's enforcement posture was one of education and guidance. That era is over.
The Enforcement Shift
In 2025, NITDA issued 23 formal investigation notices to organisations across the banking, healthcare, and fintech sectors. Six resulted in published enforcement decisions with fines ranging from ₦2 million to ₦45 million. The reputational damage to named organisations was as significant as the financial penalties.
In 2026, enforcement is expected to accelerate. NITDA has increased its compliance audit team and is actively receiving data breach notifications that trigger automatic investigation.
The Three Gaps We See Most Frequently
**1. No valid lawful basis for processing.** Many organisations still collect and process personal data under vague consent provisions buried in terms and conditions. NITDA expects specific, freely given, informed and unambiguous consent — or a clearly documented alternative lawful basis.
**2. No DPO appointed or empowered.** Organisations with more than 1,000 data subjects must appoint a Data Protection Officer. Most have done so on paper. Many have not given that person the access, independence or budget to function effectively.
**3. No Data Protection Impact Assessment conducted.** Any processing that is likely to result in high risk to data subjects requires a DPIA before the processing begins. High-risk processing is more common than most organisations assume — it includes profiling, large-scale processing, and systematic monitoring.
What to Do Now
1. Conduct a data mapping exercise to identify what personal data you hold, where it comes from, and how it is used.
2. Review and update your privacy notice to ensure it is accurate, current, and accessible.
3. Verify that your DPO has the authority, access and budget to carry out their functions.
4. Conduct a DPIA for any high-risk processing activities.
5. Ensure you have a documented breach response plan with clear notification timelines.
The cost of remediation is always lower than the cost of enforcement.
Dr. Ngozi Obiora
CIPP/E | Former NITDA Senior Policy Adviser
Dr. teaches on the Formation Exceptionelle platform. Explore their courses below.