Nigeria NDPA
compliance
Nigeria's Data Protection Act 2023 gives Africa's largest internet market a GDPR-style law with real teeth: a dedicated commission, consent as a primary basis, and fines that scale with revenue.
Trusted by 2,000+clients worldwide
NDPA at a glance
Enacted
The Nigeria Data Protection Act, June 2023; the NDPC's GAID 2025 directive (September 2025) sets the cookie rules and retired the older NDPR.
Regulator
The NDPC (Nigeria Data Protection Commission).
Penalties up to
₦10 million or 2% of annual gross revenue for major controllers.Whichever is greater
Consent standard
Freely given, specific, informed and unambiguous, and the controller must be able to demonstrate it.
This guide is general information for site owners, not legal advice. Check the current text of the law and your own counsel for your situation.
What the law requires on your website
A lawful basis
Processing needs a legal basis; for advertising and profiling cookies, consent is the workable one, and pre-ticked boxes are explicitly invalid.
Transparency
Data subjects must be told what is collected, why, and with whom it is shared, before processing.
Demonstrable consent
The NDPA places the burden of demonstrating valid consent on you; records are not optional.
How Clickio Consent helps
Serve visitors from Nigeria a consent flow configured for the NDPA: a localized dialog, granular purposes, equal-weight decline and stored records.
One tag, per-region rules
Clickio detects each visitor's location and serves the consent experience you configure for that region, this law included, without affecting any other market.
Multi-regulation →Localized dialogs
Language auto-detection and full text customization put the dialog in your visitors' language, with granular purpose choices and equal-weight decline.
Customization →Evidence on file
Every choice is stored as a consent record: the demonstrable-consent trail modern laws place on the controller.
Reporting →Frequently asked questions
Does the NDPA require cookie consent?
Yes. The NDPC's General Application and Implementation Directive (GAID 2025, in force since September 2025) says cookies other than necessary ones need a specific accept or reject choice, and the banner has to be visible without scrolling. That is the same standard the Act's consent definition sets: affirmative, informed, no pre-selected boxes.
Who enforces it?
The Nigeria Data Protection Commission (NDPC), with penalties up to ₦10M or 2% of gross revenue for larger controllers.
Does it apply to foreign websites?
Yes. The Act covers any controller processing the data of a person in Nigeria, whether or not it is based there, and the NDPC treats sites that target Nigerian users as operating in Nigeria.
How is it different from the old NDPR?
The NDPA is primary legislation with a stronger commission, clearer bases and bigger penalties. It upgraded Nigeria from regulation to full statute.
How do I evidence consent under the NDPA?
The Act puts the burden of demonstrating valid consent on the controller. Clickio stores a record of every consent decision, which is the evidence that burden calls for.
Explore other regulations
Every guide shows how the same Clickio tag serves the right consent experience for that market. Pick the next one that applies to your audience.
Add this market to your consent setup. Start with a 14-day free trial; per-region settings and multi-language dialogs start on Starter.
Per-region settings (own texts, choices and fallback) and multi-language dialogs start on the Starter plan.