Nigeria Data Protection Act, 2023, complaints, enforcement and redress

Nigeria Data Protection Act, 2023, complaints and enforcement (ss. 46 and 48; GAID 2025, arts. 39, 47 and 48)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 12 June 2023.

An enforcement supervision rule binding public and private bodies.

As of 19 September 2026.

What it requires

Expect a data subject to be able to complain to the Commission through its electronic platform or by any other reasonable means, and to have that complaint acknowledged within seven days and preliminarily evaluated.
Attend a Pre-Action Conference as often as the Commission calls one in respect of a complaint or an investigation under section 46(3) of the Act.
Keep concrete evidence of compliance with each provision you may be complained about: registration, annual Compliance Audit Returns, a filed impact assessment and an approved cross-border transfer instrument show good faith but do not answer a complaint about anything else.
Expect a data subject to be able to seek redress in court for a violation of their data privacy rights, alongside the complaint route to the Commission.

Who enforces it

Enforcement body

Nigeria Data Protection Commission (NDPC)

What it reaches

Obligation class

Governance, Reporting

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Article 39 makes the right to lodge a complaint with the Nigeria Data Protection Commission a threshold right of redress under section 37 of the 1999 Constitution and section 46 of the Act, requires the Commission to run an electronic platform for complaints and to acknowledge one within seven days while continuing to accept complaints by any reasonable means, and requires it to carry out a preliminary evaluation of each complaint; a Pre-Action Conference may be held as often as a complaint or an investigation under section 46(3) needs.

Article 47 confirms that a data subject may seek redress for a violation of their data privacy rights in court, and treats proximity and access to courts as part of what national adequacy means.

Article 48 governs how the Commission weighs evidence of compliance: registration, annual Compliance Audit Returns, a filed impact assessment and an approved cross-border transfer instrument show accountability and prima facie good faith, but do not replace concrete evidence in defence of a complaint about any other provision, and the Commission treats accountability as partial fulfilment of the cooperation section 48(6)(f) of the Act requires.

Article 49 makes the safeguarding of a data subject's constitutional privacy right the overriding consideration in judging whether an obligation was met in time. The General Application and Implementation Directive 2025, which carries the text quoted here, is made under section 37 of the 1999 Constitution and sections 1(a), 6(c), 61 and 62 of the Nigeria Data Protection Act 2023, an Act in force since 12 June 2023.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot
high_risk_decisions

Read the law

General Application and Implementation Directive (GAID) 2025
an official regulatory instrument issued by the Nigeria Data Protection Commission under sections 1(a), 6(c), 61 and 62 of the Nigeria Data Protection Act, 2023, which quotes and implements the Act's provisions in detail a directly hosted copy of the Act's own gazetted text was not found among the sources reviewed

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app