Skip to content

Regulation Tracker / Other

Nigeria Data Protection Act General Application and Implementation Directive (GAID) 2025 — Articles 43 and 44 (Emerging Technologies)

Nigeria Data Protection Commission

last revised 2025-03-20last verified 2026-09-041 versioncountry page →

RegulationIn forceRisk classificationRecord-keepingConfidentialityClient consent

map categories:Data protection and legal AIVendor due diligence

The binding directive implementing Nigeria's Data Protection Act 2023. Article 43 imposes obligations on any controller or processor deploying artificial intelligence to process personal data — documented technical and organisational parameters, a DPIA filed with the Commission, anonymisation and low-risk testing, disparate-outcome review, and continuous monitoring after deployment.

Applies to
all, firms, providers
Effective
See version history
Current version
NDPC/NDP ACT-GAID/01/2025 · 20 Mar 2025
Last verified
04 Sept 2026
Official text
ndpc.gov.ng/wp-content/uploads/2025/07/NDP-ACT-GAID-2025-MARCH-20TH.pd…

What the document requires

  • Article 43(1): controllers deploying emerging technologies such as AI must take account of the NDP Act, public policy and the GAID to safeguard data-subject privacy.
  • Article 43(2): design parameters must reflect the right not to be subject to solely automated decisions, the right to be forgotten, sensitive-data and child safeguards, cross-border rules, and privacy by design and default.
  • Article 43(3)-(4): parameters and the DPIA must be documented and filed with the Commission as part of Compliance Audit Returns; the DPIA must assess disparate outcomes and Data Subjects' Vulnerability Indexes.
  • Article 43(4)(b)-(e): assess anonymisation, test in low-risk environments, retool and retest, or discard tools posing unmitigable privacy risk; deploy continuous monitoring once judged safe.
  • Article 44(3): controllers must refrain from or cease using AI systems impossible to operate in compliance with international human rights law.

Version history

VersionDateWhat changedSource
NDPC/NDP ACT-GAID/01/2025current2025-03-20Issued 20 March 2025 (instrument dated 19 December 2024); effective 19 September 2025; replaces the NDPR 2019 as the operative implementing instrument.official

Sources

Cite this record

SafeLegalAI Legal AI Regulation Tracker, "Nigeria Data Protection Act General Application and Implementation Directive (GAID) 2025 — Articles 43 and 44 (Emerging Technologies)" (Nigeria Data Protection Commission, NDPC/NDP ACT-GAID/01/2025, 2025-03-20), safelegalai.com/regulation/other/ng-ndpa-gaid-2025 (accessed 2026-09-04). Data: CC BY 4.0.

More official documents in Other