Most Nigerian businesses that have heard of the Nigeria Data Protection Act assume it's a "big company" problem, or something a lawyer deals with only after something goes wrong. Neither is accurate. The Act applies the moment you collect personal data from anyone, and a specific, easy-to-cross number determines whether you owe the regulator a formal registration on top of that.
Here's the actual threshold, what happens above it, and what compliance means whether or not you cross it.
The law that replaced the old NDPR
If you've seen "NDPR" referenced somewhere and are wondering how it relates to the NDPA, here's the short version: the Nigeria Data Protection Regulation (NDPR) 2019 and its implementation framework are no longer in effect. The Nigeria Data Protection Act 2023 (NDPA) is now the governing law, and the General Application and Implementation Directive (GAID), issued by the Nigeria Data Protection Commission (NDPC) and effective from September 2025, is the current operational guidance for applying it. If your business's compliance documents still reference NDPR 2019 specifically, that's worth updating, not just a cosmetic detail.
The registration threshold that actually matters
If your business processes personal data (customer records, employee data, user accounts, anything tied to an identifiable person) for 200 or more people within a rolling six-month period, you're required to register with the NDPC as a data controller or data processor. This isn't about your revenue, your staff count, or your industry. It's about how many people's data actually passes through your systems.
A small business can cross this threshold faster than its owner expects. A retailer with an online store, a clinic with a patient list, a school with enrolled students, or a consultancy running WhatsApp-based client intake can all reach 200 data subjects well before they'd describe themselves as a "big" business.
The tiers above the threshold
Once you're above the 200 threshold, the GAID sorts registered controllers and processors into tiers based on data volume and sector, each with its own compliance load:
| Tier | Who it covers | What it requires |
|---|---|---|
| Entry-level (OHL) | Businesses processing roughly 200–999 data subjects in six months; schools, training providers, primary health centres, and similar | Baseline registration and compliance obligations |
| Mid-tier (EHL) | Roughly 1,000–5,000 data subjects in six months; government agencies, microfinance/mortgage banks, higher institutions, tertiary/secondary hospitals | Heavier compliance obligations tied to sector and volume |
| Ultra-high level (UHL) | The highest-volume and most sensitive processing | Mandatory Data Protection Impact Assessments (DPIAs), a qualified Data Protection Officer (DPO), and an annual Compliance Audit Return (CAR) |
A Data Protection Officer becomes mandatory specifically for data controllers or processors "of major importance", broadly, organisations at the higher tiers, or those in a regulated sector, and that person is expected to have genuine expertise in data protection law and practice, not just a title added to someone's existing role.
What compliance means below the threshold
Not being required to register with the NDPC doesn't mean the NDPA doesn't apply to you. It still does, in full, the moment you collect anyone's personal data. Below the 200-subject threshold, what's expected of you is the same core discipline, without the formal registration step:
- A lawful basis for collecting each category of personal data you handle
- A genuine privacy notice explaining what you collect, why, how long you keep it, and who you share it with, not a generic template lifted from another country's law
- Defined retention periods, not an open-ended "as long as necessary" with no actual criteria behind it
- A plan for what happens if there's a data breach, including the NDPA's 72-hour notification window to the NDPC for breaches that pose a risk
- Awareness of whether any of your data processing crosses borders (most businesses using non-Nigerian email, hosting, or analytics providers do, whether they've thought about it or not), since the NDPA restricts that by default unless specific safeguards apply
Below the registration threshold, the NDPA doesn't ask less of you in principle. It just doesn't require you to formally tell the NDPC about it yet.
Where businesses actually get caught out
- Assuming a privacy policy is the whole job. A published policy that doesn't match what the business actually does, vague retention language, no mention of a data category the business genuinely collects, is arguably worse than having none, because it's a paper trail showing the gap.
- Not tracking the six-month rolling count at all. Crossing 200 data subjects isn't a one-time event to notice and forget; it's a rolling window, so a business that dips below and back above it can still be in scope.
- Treating "data protection" as a website problem. Data collected via WhatsApp, email, in-person forms, or a physical register counts exactly the same as data collected through a web form. The NDPA doesn't care about the channel.
How do I know how many data subjects my business has processed in the last six months?
Count every identifiable individual whose personal data you've collected or handled in that window, customers, clients, employees, and website users tracked individually all count. Most businesses have never actually done this count until asked, which is itself worth fixing.
If I'm below 200 data subjects, do I still need a privacy policy?
Yes. The requirement to have a lawful basis, a genuine privacy notice, and defined retention practices applies regardless of registration status. Registration is an additional step for higher-volume processing, not the starting point for compliance.
What's the penalty for not registering when required?
The NDPA carries significant penalties for non-compliance generally, including fines calculated against annual gross revenue for serious breaches. The exact figure applicable to a specific violation is worth confirming directly rather than relying on a number seen elsewhere, since enforcement guidance continues to develop under the GAID.
Finding out where you actually stand
The honest starting point for most businesses isn't "do we need a lawyer" or "do we need to register", it's "do we actually know how much personal data we're processing, and does our current privacy policy reflect what we really do." Awal Global Consults reviews that gap directly, and handles NDPC registration for businesses that cross the threshold, rather than starting from a generic template and hoping it holds up.
Need help with this?
Awal Global Consults reviews your data handling against the NDPA's actual requirements and manages NDPC registration where it applies, rather than a generic privacy policy template.