June 18, 2026

On June 18, 2026, the Nigeria Data Protection Commission (NDPC) issued a comprehensive Guidance Notice, clarifying and enhancing the responsibilities of Data Protection Officers (DPOs) and streamlining data breach notification procedures under the Nigeria Data Protection Act (NDPA) 2023. This development marks a significant step in reinforcing Nigeria's data protection framework, providing much-needed clarity for data controllers and processors. The Notice emphasizes the critical role of DPOs in fostering a culture of compliance and details the precise steps and timelines for reporting personal data breaches, aiming to improve accountability and protect data subjects' rights more effectively across all sectors of the Nigerian economy.

The landscape of data protection in Nigeria continues to evolve rapidly, driven by the robust provisions of the Nigeria Data Protection Act (NDPA) 2023. In a move to further strengthen compliance and enforcement, the Nigeria Data Protection Commission (NDPC) on June 18, 2026, released a pivotal Guidance Notice. This Notice specifically addresses the intricate roles and responsibilities of Data Protection Officers (DPOs) and refines the protocols for personal data breach notifications, building upon the foundational principles established by the NDPA and the General Application and Implementation Directive (GAID) 2025.

This latest directive from the NDPC is not merely a procedural update; it represents a strategic effort to embed a higher standard of data governance within organisations operating in Nigeria. For legal practitioners and compliance officers, understanding these enhanced guidelines is paramount. The Notice aims to clarify ambiguities, ensure uniformity in compliance efforts, and ultimately bolster the protection of personal data, which is increasingly vital in Nigeria's burgeoning digital economy. This article will delve into the key aspects of the NDPC's Guidance Notice, examining its implications for data controllers and processors and offering practical insights for navigating the updated regulatory environment.

The journey towards a comprehensive data protection regime in Nigeria gained significant momentum with the enactment of the Nigeria Data Protection Act 2023, which received presidential assent on June 12, 2023. This landmark legislation replaced the Nigeria Data Protection Regulation (NDPR) 2019, which was initially issued by the National Information Technology Development Agency (NITDA). The NDPA 2023 established the Nigeria Data Protection Commission (NDPC) as an independent regulatory authority, tasked with overseeing the implementation of the Act, regulating data processing activities, and enforcing compliance.

The NDPA's objectives include safeguarding the fundamental rights and freedoms of data subjects, promoting secure data processing practices, and strengthening the legal foundations of the national digital economy. It draws inspiration from international best practices, such as the EU's General Data Protection Regulation (GDPR), while incorporating Nigeria-specific elements. A crucial development in the operationalisation of the NDPA was the issuance of the General Application and Implementation Directive (GAID) 2025 by the NDPC, which provides comprehensive and binding directives on various aspects, including the designation and registration of Data Protection Officers (DPOs) and data breach management. The NDPA mandates the appointment of a DPO for Data Controllers and Processors of Major Importance, defining their roles in ensuring internal compliance and serving as a liaison with the NDPC and data subjects.

The NDPC's Guidance Notice of June 18, 2026, significantly elaborates on two critical pillars of the NDPA 2023: the role of the Data Protection Officer and the procedures for data breach notification. Regarding DPOs, the Notice reinforces the requirement for Data Controllers and Processors of Major Importance to designate a qualified DPO. It clarifies that DPOs must possess expert knowledge of data protection law and practices, coupled with the ability to effectively carry out their statutory tasks. The Notice further stresses the importance of DPO independence, stipulating that DPOs should not hold conflicting responsibilities that could compromise their ability to advise objectively or report non-compliance without fear of reprisal. This includes avoiding roles with direct commercial or operational interests that the DPO is expected to scrutinise, ensuring that their primary allegiance remains with data protection compliance.

Furthermore, the Guidance Notice provides detailed expectations for DPO training and continuous professional development, encouraging organisations to engage accredited training providers and ensure certifications align with NDPA requirements. DPOs are explicitly tasked with monitoring compliance, handling data subject access requests within the stipulated 30-day timeframe, conducting regular staff training, and serving as the primary liaison with the NDPC. The Notice also reiterates that organisations can appoint an internal employee as a DPO or engage an external Data Protection Compliance Officer (DPCO), provided the external arrangement ensures genuine independence and the DPCO holds a current NDPC license.

On data breach notification, the Guidance Notice streamlines the existing procedures, emphasising the NDPA's strict 72-hour reporting window to the NDPC from the moment an organisation becomes aware of a personal data breach. It clarifies what constitutes a 'personal data breach' – any security incident leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. The obligation to notify the NDPC is triggered when such a breach is likely to result in a risk to the rights and freedoms of data subjects. For breaches likely to result in a *high risk* to data subjects, the Notice mandates notification to affected individuals without undue delay, using clear and plain language to explain the nature of the breach, the data affected, and steps individuals can take to protect themselves.

The Notice underscores the importance of having a robust incident response plan, preserving forensic evidence, and conducting thorough post-breach reviews. It also highlights the NDPC's online breach-reporting portal as the primary route for formal notifications. These clarifications are crucial, especially given the NDPC's intensified enforcement posture, as evidenced by significant fines imposed on organisations for data processing violations. The Guidance Notice serves to reduce ambiguity, ensuring that data controllers and processors are fully aware of their obligations and the severe consequences of non-compliance, thereby fostering a more secure data environment in Nigeria.

The NDPC's Guidance Notice on DPO responsibilities and data breach notification is a critical development for all entities processing personal data in Nigeria. It underscores the Commission's commitment to robust enforcement of the NDPA 2023 and signals a maturing data protection landscape. Legal practitioners must advise their clients to meticulously review their current data protection frameworks, particularly concerning DPO appointments, training, and independence, to ensure full alignment with these enhanced guidelines. Proactive measures, including regular compliance audits, comprehensive staff training, and the development of detailed incident response plans, are no longer optional but essential for mitigating legal and reputational risks.

Organisations should immediately assess their DPO's qualifications and reporting structure against the independence criteria outlined in the Notice. Furthermore, a thorough review and update of data breach response protocols are imperative, focusing on the strict 72-hour notification timeline and the clarity of communication with affected data subjects. As the NDPC continues to issue directives and intensify its enforcement activities, staying abreast of these regulatory developments will be crucial. Practitioners should anticipate further sector-specific guidelines and potential enforcement actions, making continuous monitoring of NDPC pronouncements a core aspect of data protection compliance strategy in Nigeria.