Nigeria’s data protection regime has entered a firm enforcement phase.
Under the Nigeria Data Protection Act 2023 (NDPA), the Nigeria Data Protection Commission (NDPC) is actively escalating oversight — making clear that compliance is now mandatory and enforceable.
GAID as the Operational Framework
Since 19 September 2025, the General Application and Implementation Directive (GAID) has served as the core compliance framework for organisations processing Nigerian personal data — domestic and foreign alike.
It formalises obligations around governance, breach reporting, audits, DPIAs, and cross-border transfers.
Enforcement by the Numbers
• 7.2+ billion collected in fines and compliance fees
• Thousands of organizations registered
• Hundreds of investigations launched
Penalties can reach 10 million or 2% of annual gross revenue (whichever is higher).
Heightened Scrutiny
Fintech, telecom, healthcare and digital platforms are key focus areas.
International platforms serving Nigerian users are also under investigation — signalling stronger oversight of global data processing activities.
How S8fe.ai Supports
S8fe.ai enables organizations to operationalize data compliance through regulatory mapping, automated risk assessments, DPIA workflows, and audit-ready documentation — helping businesses stay aligned with evolving frameworks like Nigeria’s.
Source: https://nigeriadataprotection.com/%E2%82%A6400-million-generated-as-data-protection-investigations-target-17-companies/