General Application and Implementation Directive (GAID) 2025
The NDPC General Application and Implementation Directive 2025 operationalises the NDP Act 2023 through rules for major-importance registration, periodic audits/CAR filings, DPO governance, privacy and consent, DPIAs, security, breach notices, data-subject rights, technology, cross-border transfers and schedules.
Overview
The NDPC General Application and Implementation Directive 2025 operationalises the NDP Act 2023 through rules for major-importance registration, periodic audits/CAR filings, DPO governance, privacy and consent, DPIAs, security, breach notices, data-subject rights, technology, cross-border transfers and schedules.
Regulatory implementation directive applying to relevant data controllers, data processors, DPOs and other parties in Nigeria or whose processing triggers the Nigerian territorial scope. The instrument distinguishes UHL/EHL annual CAR filings from OHL registration renewals, provides transitional DPIA/software requirements, and includes ten schedules, including registration guidance and fee tables. The instrument was signed and issued on 20 March 2025, according to the signed last page; publication and formal effective dates are not stated independently.
Obligations
Requirements identified from this policy that may need to be tracked by your organization.
4 identified
4 identified obligations
Perform initial compliance audit within fifteen months of business commencement
Data controllers and processors are expected to conduct their first NDP Act compliance audit within Fifteen (15) months of commencing business and repeat it annually. Imported research notes (check before approving): • Duty holders (any one of): data controller; data processor • Applies when: commencement of business • Timing in the source: "within Fifteen (15) months of commencement of business"
AuditEvent-basedwithin Fifteen (15) months of commencement of business — exact deadline not calculatedSource: Article 7(b) · Article 7(b) · page 13Suggested owner: Data Protection Officer
Renew OHL registration annually
An OHL controller or processor must renew registration annually. Article 9(3) expressly says annual CAR filing is not required when it annually renews registration. Imported research notes (check before approving): • Duty holders (any one of): data controller; data processor • Goes to: regulator (Nigeria Data Protection Commission) • Timing in the source: "on an annual basis"
RenewalAnnuallyon an annual basis — exact deadline not calculatedSource: Article 9(3) · Article 9(3) · page 16
File annual CAR using the prescribed template
Major-importance controllers and processors subject to annual CAR filing must file returns annually using Schedule 2 or a replacement template; Article 9(3) provides the OHL annual-renewal exception. Imported research notes (check before approving): • Duty holders (any one of): data controller; data processor • Goes to: regulator (Nigeria Data Protection Commission) • Timing in the source: "on an annual basis" • Flagged by the research: Article 10(6) says all major-importance entities file annually while Article 9(3) exempts annually-renewing OHL from annual CAR; apply the provisions together, subject to legal review.
FilingAnnuallyon an annual basis — exact deadline not calculatedSource: Article 10(6) · Article 10(6) · page 17
Pay applicable UHL annual CAR filing fee
UHL entities required to file CAR must pay filing fee under Schedule 10: ₦1,000,000 for 50,000+ subjects, ₦750,000 for 25,000–49,999 subjects, or ₦500,000 for below 25,000 subjects, unless modified by NDPC. Imported research notes (check before approving): • Duty holders (any one of): data controller; data processor • Goes to: regulator (Nigeria Data Protection Commission)
PaymentAnnuallySet by the customerSource: Schedule 10, paragraph 1 · Schedule 10, paragraph 1 · page 117
Sources & versions
Official sources
- Nigeria Data Protection Act (NDP Act) 2023 General Application and Implementation Directive (GAID) 2025
Official document · Nigeria Data Protection Commission · Primary source
Version and updates
- Version
- GAID 2025
- Published
- Oct 23, 2026
- Last reviewed
- Oct 23, 2026
First structured import of the GAID instrument and its ten schedules.
Remindash provides this information to help organizations identify and track potential obligations. Applicability can depend on your organization's circumstances. Review official sources and obtain professional advice where appropriate.