NDPA General Application and Implementation Directive (GAID) 2025 and AI

What it is

The Nigeria Data Protection Act General Application and Implementation Directive (GAID) 2025, reference NDPC/NDP ACT-GAID/01/2025, is the Nigeria Data Protection Commission’s main instrument for applying the Nigeria Data Protection Act 2023. The National Commissioner issued it on 20 March 2025 and it took effect on 19 September 2025. Article 3 says that on its issuance the Commission ceased to apply the Nigeria Data Protection Regulation 2019 as a legal instrument for regulating data processing.

The GAID has 52 articles and 10 schedules. It covers registration of data controllers and processors of major importance, compliance audit returns, data protection officers, consent, impact assessments, cross-border transfers and emerging technologies. Where it conflicts with the Act, the Act prevails.

Who it applies to

The GAID applies to data controllers and processors within the reach of the Act, which covers organisations domiciled, resident or operating in Nigeria and those outside Nigeria processing personal data of data subjects in Nigeria. Article 8 says operating in Nigeria includes targeting data subjects in Nigeria without being domiciled or resident there.

Controllers and processors of major importance carry more obligations. Article 8 sorts them into three levels, Ultra-High, Extra-High and Ordinary-High, and the factors the Commission weighs include reliance on third-party servers or cloud computing, substantial cross-border data flows and the automation of data processing.

What it requires

Impact assessments

Article 28 builds on section 28 of the Act. Article 28(3) makes a data privacy impact assessment mandatory, and to be filed with the Commission, in a list of circumstances that includes

• evaluation or scoring, meaning profiling;
• automated decision-making with legal or similar significant effects;
• systematic monitoring;
• sensitive or highly personal data and vulnerable data subjects;
• innovative processes or new technological or organisational solutions that may pose a significant privacy risk; and
• financial services processing personal data through digital devices, health care, e-commerce, education and hospitality, and cross-border data transfer.

A DPIA must be carried out and submitted before processing starts. It must be vetted by a certified DPO accredited by the Commission, and its outcome forms part of the compliance audit return. Article 28(6) warns that failing to carry out a DPIA may lead to restrictions on the platforms through which an organisation deals with data subjects.

Emerging technologies, including AI

Article 43 applies to any controller or processor that deploys or intends to deploy emerging technologies such as artificial intelligence, the Internet of Things and blockchain to process personal data. It must take into account the Act, public policy, the GAID and the Commission’s other instruments, and set out technical and organisational parameters so its tools stay within what the law allows. Article 43(2) names the right not to be subject to a decision based solely on automated processes or algorithms, the right to be forgotten, safeguards for sensitive data and for children and other vulnerable groups, cross-border data flows, and privacy by design and by default.

Those parameters are documented and filed with the Commission as part of the compliance audit return. Article 43(4) then sets out a cycle.

• Assess. Carry out a DPIA that takes into account disparate outcomes of the processing and the Data Subjects’ Vulnerability Indexes in Schedule 6.
• Reduce and test. Consider anonymising data on collection, and testing the technology in low-risk environments where significant outcomes can be observed.
• Check outcomes. Determine whether there are disparate outcomes and whether they can be addressed.
• Retool or discard. Return to the controlled environment and retest until outcomes are satisfactory, or discard the tool where the privacy risk cannot be mitigated.
• Monitor. Once the technology is judged safe, put a mechanism in place for continuous monitoring and evaluation wherever it is deployed.

Article 44 lets organisations benchmark against global consensus such as the United Nations resolution on artificial intelligence, and says they should refrain from or stop using systems that cannot be operated in line with international human rights law or that pose undue risks to human rights.

Consent for automated decisions

Article 18(1)(f) lists consent as required before a data controller makes a decision based solely on automated processing which produces legal effects concerning or significantly affecting the data subject, without prejudice to the Act. Organisations relying on the contract or written-law exceptions in section 37 of the Act should take advice on how the two provisions fit together for their case.

Key dates

• 20 March 2025. The GAID is issued.
• 19 September 2025. The GAID takes effect, and the NDPR 2019 and its 2020 Implementation Framework cease to apply.

How it relates to other frameworks

Article 43 reads like a short AI lifecycle standard placed inside data protection law. Its cycle of assessment, testing, outcome checks and continuous monitoring lines up with the impact assessment approach in ISO/IEC 42005 and the management system in ISO/IEC 42001. Its focus on disparate outcomes is the same question a bias assessment asks. The mandatory DPIA list resembles the high-risk triggers regulators use under the GDPR, though the GAID adds whole sectors such as digital financial services and e-commerce.

A note on this page

This is Aicura’s reading of the GAID 2025. It is not legal advice and it is not the directive itself. Read the GAID as published by the Nigeria Data Protection Commission, and take advice on how it applies to your organisation.