Map your NDPR controls and move to Nigeria's NDPA with confidence
The NDPR (Nigeria Data Protection Regulation 2019) is the regulation NITDA issued in January 2019 to govern how personal data of people in Nigeria is collected, used and protected. It set rules on lawful processing, consent, privacy policies, data security, foreign transfers, data subject rights and annual data protection audits. Since March 2025 the Nigeria Data Protection Commission no longer applies it, and the Nigeria Data Protection Act 2023 and the GAID 2025 now govern.
Is NDPR right for your organisation?
The NDPR applied to every public and private organisation processing personal data of people in Nigeria, and of Nigerian citizens living abroad. Today it matters mainly to organisations reviewing past NDPR audit filings, contracts and policies written against it, and teams moving their privacy programme onto the Nigeria Data Protection Act 2023.
It is a legal or regulatory requirement for organisations in scope.
- Issued by
- National Information Technology Development Agency (NITDA)
- Signed
- 25 January 2019
- Current status
- No longer applied by the NDPC since the GAID was issued on 20 March 2025; acts done under it remain valid
- Replaced by
- Nigeria Data Protection Act 2023 and NDP Act General Application and Implementation Directive (GAID) 2025
- Maximum penalty
- 2% of the previous year's annual gross revenue or 10 million naira, whichever is greater (controllers with more than 10,000 data subjects)
- Audit filing
- Annual audit summary to NITDA by 15 March for controllers processing data of more than 2,000 data subjects in 12 months
- OneClickComply status
- Mapped in the control library, available on request
- Type
- Regulation (mandatory)
- Region
- Nigeria, Middle East & Africa
OneClickComply makes it simple
The NDPR is mapped in OneClickComply's control library and available on request, so its consent, notice, security, transfer and audit obligations sit alongside the controls you already run for GDPR and ISO 27001. Evidence collected once counts towards every framework it applies to, and AutoComplete generates privacy and security policies from your real environment. Our in-house audit team can help you see where NDPR controls carry across to the Nigeria Data Protection Act.
Requirements covered
19 articles across four parts: preliminary provisions, governing principles of processing (Articles 2.1 to 2.12), data subject rights (Article 3.1, with 16 paragraphs) and implementation mechanisms including audits and the Administrative Redress Panel (Articles 4.1 to 4.3).
Manual NDPR vs. OneClickComply
- Reading the NDPR, its Implementation Framework, the NDPA and the GAID side by side to work out what still applies
- Rebuilding the Article 4.1(5) audit content in spreadsheets every year
- Chasing screenshots to prove encryption, access control and firewall settings
- Keeping privacy notices in line with the long Article 3.1(7) information list
- Duplicating the same work for GDPR, ISO 27001 and Nigerian privacy rules
- NDPR controls mapped next to NDPA and GDPR so overlaps and gaps are clear
- Audit-ready records of data, purposes, consent and security kept current in one place
- Security evidence collected automatically from connected tools, with OneClickFix for supported misconfigurations
- Privacy policies generated from your real environment and updated as it changes
- Evidence collected once and counted towards every framework it applies to
Everything you need for NDPR
NDPR requirements mapped to one shared set of privacy and security controls
Evidence for Article 2.6 security measures collected from cloud, identity and device tools
AutoComplete privacy policies covering the Article 2.5 and 3.1(7) content
Vendor risk management for third party processing contracts under Article 2.7
Risk register and continuous monitoring with alerts when controls drift
Ask an Auditor guidance on moving NDPR controls onto the NDPA 2023
Three steps to NDPR compliance
Connect & scan
Connect your cloud, identity and SaaS tools. OneClickComply checks them against NDPR and shows you exactly where you stand.
Fix & generate
OneClickFix remediates technical gaps in one click, and AutoComplete generates NDPR-aligned policies from your real environment.
Monitor & evidence
Continuous monitoring keeps you compliant, and our in-house audit team is on hand when you need expert guidance.
Nigeria Data Protection Regulation (NDPR) 2019 requirements
All 19 articles of the NDPR 2019, with the paragraphs of Articles 2.1, 2.3, 3.1 and 4.1 listed separately.
| Reference | Requirement |
|---|---|
| 1.1 | Objectives of the Regulation |
| 1.2 | Scope of the Regulation |
| 1.3 | Definitions |
| 2.1(1)(a) | Processing for a specific, legitimate and lawful purpose |
| 2.1(1)(b) | Adequate and accurate personal data |
| 2.1(1)(c) | Storage only for as long as reasonably needed |
| 2.1(1)(d) | Security against foreseeable hazards and breaches |
| 2.1(2) | Duty of care owed to data subjects |
| 2.1(3) | Accountability for data processing |
| 2.2 | Lawful processing |
| 2.3(1) | Purpose made known before collection |
| 2.3(2) | Consent obtained without fraud, coercion or undue influence |
| 2.4 | Due diligence and prohibition of improper motives |
| 2.5 | Publicity and clarity of privacy policy |
| 2.6 | Data security |
| 2.7 | Third party data processing contract |
| 2.8 | Objections by the data subject |
| 2.9 | Advancement of right to privacy |
| 2.10 | Penalty for default |
| 2.11 | Transfer to a foreign country |
Always check the official NDPR text for the exact wording.
NDPR FAQs
What is the NDPR?
The NDPR is the Nigeria Data Protection Regulation 2019, issued by the National Information Technology Development Agency (NITDA) and signed on 25 January 2019. It was Nigeria's main data protection instrument until the Nigeria Data Protection Act 2023, setting rules on lawful processing, consent, privacy policies, data security, transfers abroad, data subject rights, Data Protection Officers and annual data protection audits.
Is the NDPR still in force?
No. Article 3(3) of the NDP Act General Application and Implementation Directive (GAID) 2025, issued by the Nigeria Data Protection Commission on 20 March 2025, says the Commission ceases to apply the NDPR as a legal instrument. Anything done under the NDPR before then, such as audit filings, is not affected. The Nigeria Data Protection Act 2023 and the GAID now govern data protection in Nigeria.
Who had to comply with the NDPR?
The NDPR applied to all transactions involving the processing of personal data of natural persons residing in Nigeria, and of Nigerian citizens residing outside Nigeria. That covered public and private organisations of every size, whatever the means of processing. Controllers above set thresholds also had to file data protection audit summaries with NITDA, including an annual summary by 15 March.
What were the penalties under the NDPR?
Under Article 2.10, a data controller dealing with more than 10,000 data subjects faced a fine of 2% of the previous year's annual gross revenue or 10 million naira, whichever was greater. A controller dealing with fewer than 10,000 data subjects faced 1% of annual gross revenue or 2 million naira, whichever was greater. These applied in addition to any criminal liability.
How does the NDPR relate to the Nigeria Data Protection Act 2023?
The Nigeria Data Protection Act 2023 gives Nigeria a statutory data protection law and created the Nigeria Data Protection Commission (NDPC). Many NDPR principles, such as lawful bases, consent, data subject rights, security and transfer rules, carry across into the Act. The GAID 2025 explains how the Act is applied and confirms the NDPC no longer applies the NDPR, so new compliance work should target the Act.
How is the NDPR similar to GDPR?
The NDPR borrows heavily from the EU GDPR. Its lawful bases, consent conditions, privacy notice content and data subject rights, including erasure, restriction and data portability, closely follow GDPR wording. Organisations with a mature GDPR programme will find most NDPR controls already in place, although Nigerian specifics such as audit filing with NITDA and the penalty structure differed.
What did an NDPR audit have to cover?
Article 4.1(5) required each organisation to audit its privacy and data protection practices. The audit had to state the personal data collected on staff and the public, the purposes, notices given, access and correction rights, how consent was obtained, security and proper use policies, privacy procedures, how violations were monitored and reported, and how the impact of technologies was assessed.
Does OneClickComply support the NDPR?
The NDPR is mapped in OneClickComply's control library and is available on request rather than live as a standard you can adopt today. Its requirements sit alongside controls you may already run for GDPR and ISO 27001, so evidence is collected once and reused. OneClickComply does not certify compliance, but our in-house audit team can guide your move to the Nigeria Data Protection Act.
Related standards
All standards- NCA Essential Cybersecurity Controls (ECC-1:2018)Regulation · Middle East & Africa
- Saudi Arabia Operational Technology Cybersecurity Controls (OTCC-1:2022)Regulation · Middle East & Africa
- NCA Critical Systems Cybersecurity Controls (CSCC-1:2019)Regulation · Middle East & Africa
- Israel Cyber Defense Methodology for an Organization (Version 1.0)Framework · Middle East & Africa
- Kenya Data Protection Act 2019Law · Middle East & Africa
- Saudi Aramco Third Party Cybersecurity Standard (SACS-002)Standard · Middle East & Africa
- NCA Cybersecurity Guidelines for Internet of Things (CGIoT-1:2024)Guidance · Middle East & Africa
- Saudi Arabia Personal Data Protection Law (PDPL)Law · Middle East & Africa
Get NDPR ready, not stressed
Automate controls, gather evidence continuously and stay audit-ready, all on one platform.