Nigeria 2026, What the National Assembly's Review of the National Data Protection Act (NDPA) Means for Businesses and AI Projects

In May 2026, Nigeria’s National Assembly publicly signalled its intention to review the National Data Protection Act Nigeria enacted in 2023, citing the rapid expansion of artificial intelligence, escalating cyber threats, and the need for stronger enforcement mechanisms. For in-house counsel, Data Protection Officers, CTOs, and compliance officers at Nigerian and multinational organisations, this legislative review creates both urgency and uncertainty: existing obligations under the NDPA remain fully enforceable, yet the rules governing AI, cross-border data transfers, and breach notification could shift materially within the coming legislative cycle.

This guide provides a practical compliance roadmap, grounded in the current Act, the Nigeria Data Protection Commission’s (NDPC) General Application and Implementation Directive (GAID), and the parliamentary signals reported to date, so that organisations can act now rather than scramble later.

Key Takeaways

• The NDPA 2023 is current law. Every obligation it imposes remains enforceable while the National Assembly conducts its review.
• Amendment areas in focus. Industry observers expect the review to target enforcement penalties, AI and automated decision-making (ADM), breach notification timelines, and cross-border transfer controls.
• AI projects carry heightened risk. Organisations deploying machine-learning models on Nigerian personal data should conduct Data Protection Impact Assessments (DPIAs) immediately.
• A 90-day compliance sprint is advisable. Even before amendments are tabled, organisations should complete impact assessments, update vendor contracts, and build NDPC audit-readiness files.
• NDPC audits are active. The Commission has been issuing directives and guidance under the GAID, and early indications suggest audit frequency will increase alongside the legislative review.

Quick Overview: National Data Protection Act Nigeria, Scope, Principles and Regulator

The National Data Protection Act 2023 (NDPA) is Nigeria’s primary data protection legislation. It replaced the earlier Nigeria Data Protection Regulation (NDPR) 2019 and established a comprehensive, statute-based framework for the processing of personal data. The Act also created the Nigeria Data Protection Commission (NDPC) as an independent regulatory body with investigation, enforcement, and penalty-issuing powers.

Who Is Covered, Controllers and Processors Inside and Outside Nigeria

The NDPA applies to any data controller or data processor that processes the personal data of individuals residing in Nigeria, regardless of whether the controller or processor is itself located in Nigeria. This extraterritorial reach means that foreign cloud providers, SaaS platforms, and multinational employers with Nigerian staff or customers fall squarely within the Act’s scope. Controllers bear primary accountability for lawful processing; processors must act only on documented instructions and comply with security and breach-response obligations.

Core NDPA Principles

The Act codifies principles that will be familiar to anyone who has worked with the EU’s GDPR or the African Union Convention on Cyber Security. These principles form the foundation for every compliance assessment:

• Lawfulness, fairness, and transparency. Personal data must be processed on a valid legal basis and in a manner that is transparent to the data subject.
• Purpose limitation. Data collected for a specified purpose must not be further processed in a manner incompatible with that purpose.
• Data minimisation. Only data that is adequate, relevant, and limited to what is necessary should be collected.
• Accuracy. Controllers must take reasonable steps to ensure personal data is accurate and up to date.
• Storage limitation. Data should be kept in identifiable form only for as long as necessary for the stated purpose.
• Integrity and confidentiality. Appropriate technical and organisational measures must protect data against unauthorised access, loss, or destruction.
• Accountability. Controllers must demonstrate compliance with all of the above principles.

NDPC Powers, Registration and DPCO Licensing

The NDPC serves as the supervisory authority under the National Data Protection Act Nigeria framework. Its mandate includes receiving complaints from data subjects, conducting investigations and compliance audits, and issuing enforcement notices. The Commission also administers a registration regime for data controllers and processors of major importance, requiring them to file details of their processing activities.

A distinctive feature of Nigeria’s regime is the licensing of Data Protection Compliance Organisations (DPCOs). These are third-party firms authorised by the NDPC to conduct data protection audits and assist controllers with compliance. Under the GAID issued by the NDPC, organisations that meet specified thresholds must engage a licensed DPCO to carry out annual audits and submit audit reports to the Commission. The likely practical effect of the 2026 review will be to tighten these audit requirements and raise the stakes for non-compliance.

What the National Assembly’s 2026 Review Could Change, Likely NDPA Amendment Areas

The parliamentary review signals reported in May 2026 point to several areas where amendments are either likely or possible. It is important to distinguish between the two: “likely” amendments are those where political momentum, NDPC advocacy, and international regulatory trends all converge; “possible” amendments are those under discussion but without clear consensus. The analysis below reflects editorial commentary based on publicly reported signals and regulatory trends, no amendment bill text has been published at the time of writing.

Enforcement and Penalties

Industry observers expect the National Assembly to expand the NDPC’s enforcement toolkit. Under the current Act, the Commission can issue compliance notices, conduct investigations, and impose administrative fines. However, early indications suggest lawmakers are considering graduated penalty scales tied to annual turnover, a model already adopted by the EU’s GDPR and Kenya’s Data Protection Act. The likely practical effect would be substantially higher financial exposure for large-scale data controllers, particularly in financial services, telecommunications, and e-commerce. Penalty caps may also be introduced for smaller enterprises to avoid disproportionate impact.

Separately, there are signals that the review may grant the NDPC power to order the suspension of processing activities, a far more disruptive sanction than fines alone. Organisations should model their risk exposure under both current and potential penalty regimes.

AI and Automated Decision-Making Carve-Outs

The intersection of AI regulation Nigeria businesses face and data protection law is a central driver of the review. The current NDPA does not contain explicit provisions addressing automated decision-making, algorithmic profiling, or machine-learning model training. Industry observers expect the review to introduce at minimum a right for data subjects to obtain human review of solely automated decisions that produce legal or similarly significant effects, mirroring Article 22 of the GDPR.

A possible further step would be mandatory algorithmic impact assessments for high-risk AI systems processing Nigerian personal data. If enacted, this would require organisations to document the logic, training data provenance, and fairness testing of AI models before deployment. Companies building or procuring AI tools should begin these assessments now, as retroactive compliance will be significantly more costly.

Cross-Border Transfers and Localisation Risk

Cross-border data transfers Nigeria organisations routinely undertake, to cloud providers, group companies, and offshore processors, are likely to face stricter scrutiny. The current NDPA permits transfers where the receiving country provides an adequate level of protection or where appropriate safeguards (such as contractual clauses) are in place. The review may introduce a formal adequacy-determination process managed by the NDPC, as well as mandatory transfer impact assessments. Data localisation requirements, mandating that certain categories of data be stored on servers physically located in Nigeria, remain a possible but more contentious proposal.

Audit and Compliance Regimes

The DPCO audit model is likely to be strengthened. Early indications suggest amendments may expand the categories of organisations required to undergo mandatory annual audits and increase the documentation that must be submitted to the NDPC. Organisations that currently fall below the audit threshold should assess whether expanded thresholds would capture them.

AI Projects and Automated Decision-Making, Legal Risk Matrix and Mitigation Under the National Data Protection Act Nigeria

For CTOs and AI teams, the combination of existing NDPA obligations and anticipated amendments creates a specific set of legal risks that must be managed proactively. Even without explicit AI provisions in the current Act, core data protection principles, lawfulness, data minimisation, accuracy, and accountability, apply to every AI system that processes personal data.

NDPA Obligations That Matter to AI

Several provisions of the current National Data Protection Act Nigeria framework have direct implications for AI and machine-learning projects. The data minimisation principle limits the volume and categories of personal data that may be ingested into training datasets. The accuracy principle requires that models producing outputs about individuals be reasonably accurate and subject to correction. The accountability principle demands that controllers be able to demonstrate, through documentation, audit trails, and impact assessments, that their AI systems comply with the law. Where AI systems process special categories of personal data (health data, biometric data, or data revealing ethnic origin), additional safeguards apply.

Practical Mitigation Checklist for AI Projects

• Conduct a DPIA before deployment. Document the necessity, proportionality, risks, and mitigations for every AI system processing personal data.
• Implement human oversight mechanisms. Ensure that decisions with legal or significant effects on individuals can be reviewed by a qualified person.
• Maintain model cards. Record training data provenance, bias testing results, performance metrics, and intended use cases for each model.
• Audit training data. Verify that training datasets were collected lawfully, with valid consent or another legal basis under the NDPA.
• Build explainability outputs. Design systems so that data subjects can receive a meaningful explanation of how an automated decision was reached.
• Review vendor AI terms. If procuring AI tools from third parties, ensure contracts address data protection obligations, sub-processing, and liability allocation.

Example Language for Contracts and Vendor Controls

When engaging AI vendors or cloud-based ML platforms, organisations should include contractual provisions that address NDPA compliance specifically. Key clauses include: processor obligations to act only on documented instructions; restrictions on secondary use of personal data for model training; audit rights allowing the controller (or its DPCO) to inspect the vendor’s processing operations; and data breach notification timelines that are at least as strict as the NDPA requires.

AI Risk Matrix

Immediate Compliance Actions, 90-Day Roadmap for Data Protection Compliance Nigeria

Organisations do not need to wait for the National Assembly to table a bill before taking action. The current NDPA is fully in force, and the NDPC has been actively issuing guidance and conducting audits. The following 90-day roadmap provides a structured approach to strengthening compliance posture while the legislative review unfolds.

0–30 Days: Rapid Impact Assessment

The first priority is understanding the organisation’s current exposure. This phase should produce a clear picture of what personal data the organisation processes, on what legal basis, and where it flows.

• Inventory all personal data processing activities. Map data flows across business units, identifying controllers, processors, and sub-processors.
• Identify NDPA legal bases. For each processing activity, confirm the legal basis relied upon (consent, legitimate interest, contractual necessity, legal obligation, vital interest, or public interest).
• Flag high-risk processing. Prioritise activities involving special categories, large-scale profiling, cross-border transfers, or AI/automated decision-making.
• Assess NDPC registration status. Confirm whether the organisation meets the threshold for mandatory registration with the Nigeria Data Protection Commission and whether current filings are up to date.
• Review existing DPIAs. If DPIAs have been conducted, verify they cover current processing activities. If none exist, schedule them for the next phase.

30–60 Days: NDPC Compliance Audit Readiness and Contract Remediation

With the data inventory complete, the focus shifts to preparing the documentary evidence the NDPC will expect during an audit and remediating contractual gaps.

• Compile an audit-readiness file. This should include data processing agreements, privacy notices, consent records, DPIAs, breach-response procedures, and training logs.
• Engage a licensed DPCO. If the organisation meets the mandatory audit threshold, appoint a DPCO and schedule the annual audit. Even if below the threshold, a voluntary audit demonstrates good faith.
• Remediate processor contracts. Review all agreements with data processors, particularly international cloud vendors, to ensure they contain NDPA-compliant clauses covering processing instructions, security measures, sub-processing, breach notification, and audit rights.
• Update privacy notices and consent mechanisms. Ensure that all customer- and employee-facing notices accurately reflect current processing activities and legal bases.

60–90 Days: Governance Changes, DPIAs, Employee Training and Documentation

The final phase embeds data protection compliance Nigeria organisations need into ongoing governance structures rather than treating it as a one-off project.

• Appoint or empower a DPO. Designate a Data Protection Officer with sufficient authority, resources, and reporting lines to the board or senior management.
• Conduct DPIAs for high-risk processing. Complete formal DPIAs for all activities flagged in the first phase, with particular attention to AI systems and cross-border transfers.
• Roll out employee training. Deliver role-based data protection training to all staff who handle personal data, with documented attendance and assessment records.
• Establish a breach-response protocol. Create and test an incident response plan that includes internal escalation, NDPC notification procedures, forensic evidence preservation, and data subject communication templates.
• Document everything. The accountability principle requires demonstrable compliance. Maintain a centralised compliance register that is updated at least quarterly.

NDPC Enforcement, Audits and Compliance Evidence, What Regulators Will Look For

The NDPC has been building its enforcement capacity since the NDPA came into force, and the GAID provides detailed implementation guidance for regulated entities. Understanding what the Commission expects during an NDPC compliance audit is essential for any organisation processing Nigerian personal data at scale.

Typical audit triggers include complaints from data subjects, breach notifications that reveal systemic weaknesses, failure to register or file annual audit reports, and sector-wide sweeps targeting industries with high volumes of personal data (banking, telecoms, health tech, and e-commerce). The NDPC assesses compliance across multiple dimensions: lawfulness of processing, adequacy of security measures, completeness of documentation, and responsiveness to data subject rights requests.

NDPC Audit Evidence Checklist

The likely practical effect of the 2026 review is that audit obligations will expand. Organisations that build comprehensive audit-readiness files now will be better positioned regardless of whether the threshold for mandatory audits is lowered or the scope of required documentation is broadened.

Contracts, Cross-Border Transfers and Vendor Management

Contractual controls are a front-line defence for data protection compliance Nigeria businesses rely upon, particularly when personal data flows to processors or group companies outside the country. The current NDPA permits cross-border data transfers where adequate safeguards are in place, but the 2026 review may introduce a formal adequacy framework and mandatory transfer impact assessments.

Contract Clause Checklist

• Processing instructions. Define the scope, nature, and purpose of processing; restrict processing beyond documented instructions.
• Security obligations. Specify minimum technical and organisational measures, including encryption standards and access controls.
• Sub-processor controls. Require prior written consent for sub-processing; impose flow-down obligations.
• Breach notification. Set contractual notification timelines (e.g., within 24–48 hours of becoming aware of a breach) that meet or exceed NDPA requirements.
• Audit rights. Reserve the right for the controller or its DPCO to inspect the processor’s operations and records.
• Data return and deletion. Specify obligations upon contract termination, including secure deletion and certification.
• Liability and indemnification. Allocate risk for NDPA non-compliance; include indemnities for regulatory fines where permitted.

Reporting and Breach Notification Obligations by Entity Type

Conclusion, Recommended Next Steps for National Data Protection Act Nigeria Compliance

The National Assembly’s 2026 review of the National Data Protection Act Nigeria framework is not a reason to wait, it is a reason to accelerate compliance. Every obligation under the current NDPA remains enforceable, and the direction of reform points unambiguously toward stronger enforcement, broader audit requirements, and new rules for AI and cross-border transfers. Organisations that act now will navigate the transition with far less disruption than those that defer.

Five priority actions stand out. First, complete a data processing inventory and rapid impact assessment within 30 days. Second, build an NDPC audit-readiness file and remediate processor contracts within 60 days. Third, conduct DPIAs for all high-risk processing, especially AI systems, within 90 days. Fourth, establish a tested breach-response protocol with forensic vendor support. Fifth, monitor the legislative review and NDPC directives closely, adjusting governance frameworks as amendment details emerge. Qualified data protection lawyers in Nigeria can provide tailored guidance on each of these steps, from NDPC registration and DPCO engagement to AI governance advisory and cross-border transfer structuring.

Disclaimer: This article provides general legal information current as of May 17, 2026. It does not constitute legal advice. Organisations should obtain advice tailored to their specific circumstances from a qualified legal professional. The legislative review discussed is ongoing, and the content will be updated as the National Assembly and NDPC publish further materials.

Sources

1. Nigeria Data Protection Act 2023 (official PDF), ngCERT
2. Nigeria Data Protection Commission, GAID (March 2025)
3. Nigeria Data Protection Commission, About Us
4. KPMG, Nigeria Data Protection Act 2023 Review
5. Aluko & Oyebode, Nigeria Data Protection Act 2023 Insights
6. DLA Piper, Data Protection Laws of the World: Nigeria
7. Mondaq, Nigeria Data Privacy Law 2025: NDPA & GAID Guide
8. CookieYes, Nigeria Data Protection Act (NDPA) Guide