The framework
The operative statute in Nigeria is the Nigeria Data Protection Act (NDPA) 2023 + GAID 2025, enforced by the Nigeria Data Protection Commission.
For media planning that means an opt-in posture, with consent capture built before campaigns launch.
Key instruments
Nigeria Data Protection Act (NDPA) 2023 + GAID 2025
Africa's largest market moved from regulation to statute with the NDPA in June 2023, then operationalized it with the General Application and Implementation Directive (GAID), issued March 2025 and effective September 2025. The NDPC registers major data handlers, audits actively and has sanctioned banks and fintechs, and in February 2026 it opened an investigation into Temu covering about 12.7 million Nigerian users. Treat Nigeria as a real enforcement jurisdiction.
Marketing and advertising
Consent or another lawful basis including legitimate interests, but direct marketing expects consent and a clear opt-out; the GAID details consent standards. Treat the consent note above as the planning rule; the penalty line below is what mispricing it costs.
Cross-border transfers
Adequacy, safeguards or derogations under the NDPA and GAID; the NDPC has not published a list of adequate destinations.
Enforcement and penalties
Up to NGN 10M or 2% of annual gross revenue for major data handlers, whichever is higher.