Nigeria's first comprehensive primary data-protection law — establishes the Nigeria Data Protection Commission, codifies rights, mandates DPO appointments.
The NDPA replaced the 2019 NDPR Regulation (which was administrative). It establishes the Nigeria Data Protection Commission (NDPC) as an independent statutory regulator, codifies the rights of data subjects (access, rectification, erasure, portability), and requires organisations to appoint Data Protection Officers where they process significant personal data. Penalty regime up to 2% of annual gross revenue or ₦10M — whichever is higher.