Nigeria Data Protection Act 2023 (NDPA): every control, and what you already have

50 controls 161 frameworks share controls with it Nigeria verified against its source document

Every control below is one this framework asks for. The right hand column counts how many other frameworks in our corpus carry the same control, which is the difference between doing this work once and doing it again for the next standard.

There is no implementation kit for this framework yet. The control list and the overlap above are free and complete.

What you already have

Frameworks whose controls overlap this one, most first. If you run any of them, the count is roughly what you have already evidenced.

If you run	Shared controls
Nebraska Data Privacy Act	8	measure it →
ASD Strategies to Mitigate Cyber Security Incidents	7	measure it →
Bahrain PDPL	7	measure it →
Barbados Data Protection Act 2019	7	measure it →
Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL)	7	measure it →
FTC GLBA Safeguards Rule (16 CFR Part 314)	7	measure it →
ISO 27017	7	measure it →
ISO 27018	7	measure it →
ISO/IEC 27400:2022	7	measure it →
NIST SP 800-124 Revision 2	7	measure it →
Pakistan Personal Data Protection Bill 2023	7	measure it →
Privacy Act 1988 (Australia)	7	measure it →

Every control

Code	Control	Also in
`NG-NDPA-1`	Scope, Applicability, and Establishment of Nigeria Data Protection Commission	161
`NG-NDPA-2`	Lawful Basis, Consent, and Data Protection Principles	144
`NG-NDPA-3`	Sensitive Personal Data, Children, and Special Categories	1
`NG-NDPA-4`	Data Subject Rights and Automated Decision-Making	65
`NG-NDPA-5`	Security of Processing, Breach Notification, and DPIA	140
`NG-NDPA-6`	Data Protection Officer, DPCO, and Processor Agreements	51
`NG-NDPA-7`	Cross-Border Data Transfers and International Cooperation	110
`NG-NDPA-8`	Enforcement, Penalties, Data Controllers of Major Importance (DCMI), and Compliance	47
`1`	Objectives	0
`2`	Application	0
`24`	Principles of personal data processing	0
`25`	Lawful basis of personal data processing	0
`26`	Consent	0
`27`	Provision of information to the data subject	0
`28`	Data privacy impact assessment	0
`29`	Obligations of the data controller and data processor when engaging a processor	0
`3`	Exemption of application	0
`30`	Sensitive personal data	0
`31`	Children or persons lacking the legal capacity to consent	0
`32`	Data Protection Officers	0
`33`	Data protection compliance services	0
`34`	Rights of a data subject: access, copy, correction, erasure and restriction	0
`35`	Withdrawal of consent	0
`36`	Right to object	0
`37`	Automated decision making	0
`38`	Data portability	0
`39`	Security, integrity and confidentiality	0
`4-23`	Parts II to IV: the Nigeria Data Protection Commission, its Council, staff and finances	0
`40`	Personal data breaches	0
`40(1)`	Breach notification by a data processor to the controller	0
`40(2)`	Breach notification to the Commission within 72 hours	0
`40(3)`	Communication of a breach to data subjects	0
`40(4)`	Content of breach notifications and communications	0
`40(8)`	Record of personal data breaches	0
`41`	Basis for cross-border transfer of personal data	0
`42`	Adequacy of protection	0
`43`	Other bases for transfer of personal data outside Nigeria	0
`44`	Registration of data controllers and data processors of major importance	0
`44(1)-(2)`	Registration of data controllers and data processors of major importance	0
`44(3)`	Notification of significant changes to registration	0
`45`	Fees and levies	0
`46`	Complaints and investigations: cooperation with the Commission	0
`47`	Compliance orders	0
`48-52`	Enforcement orders, sanctions, offences, judicial review, civil remedies and forfeiture	0
`53`	Joint and vicarious liability	0
`54-59`	Part XI: legal proceedings	0
`60-63`	Ministerial directives, regulations, directives, codes and guidelines, and priority of the Act	0
`64`	Transitional provisions	0
`65`	Interpretation	0
`GAID-2025`	General Application and Implementation Directive (GAID) 2025	0

Tell me when Nigeria Data Protection Act 2023 (NDPA) files something new

One email when a public company newly discloses something this framework governs, naming the company and what our corpus says it puts in scope. Nothing else, and one click to stop.

What an auditor will ask you to produce

The artefacts named on the failure modes this framework speaks to.

Annual training records
DCMI registration
RoPA register
Board approval of risk measures
Management body cybersecurity training records
Senior leader liability documentation
Sensitive data inventory
Age verification mechanism
COPPA compliance attestation
Age verification step before processing

How programmes fail on this

Failure modes named by this framework and others. Each opens the full record.

Missing training named by 7 frameworks
No age verification named by 7 frameworks
Late responses named by 7 frameworks
Stale compliance review named by 3 frameworks
No prior consultation named by 3 frameworks

What this page is

A control-level reference for Nigeria Data Protection Act 2023 (NDPA), drawn from our framework corpus. Control codes and titles are references to the standard, not reproductions of it. The overlap counts and the auditor artefacts are our own work and are the part you will not find elsewhere.

Measure this against what you already run · All frameworks · Today's edition