What organisations should know about GAID 2025
The NDPC's General Application and Implementation Directive explains how the NDPA works in practice. Here is what it means for registration, audit returns and licensed compliance organisations.
The Nigeria Data Protection Act 2023 sets out the law. The General Application and Implementation Directive (GAID) 2025, issued by the Nigeria Data Protection Commission, explains how organisations should apply it. GAID replaced the earlier Nigeria Data Protection Regulation (2019) and its Implementation Framework (2020).
Annual compliance audit returns
Under GAID, data controllers that fall within the reporting categories must file a compliance audit return every year before 31 March. The return describes how the organisation has complied with the Act over the previous year.
Two points matter in practice:
- Only a licensed Data Protection Compliance Organisation (DPCO) can file the return and provide the verification statement that goes with it.
- According to the NDPC, organisations in the Ordinary High Level category that process the data of fewer than 200 data subjects do not file a return, but they still renew their registration every year.
For the 2025 return, the NDPC extended the filing deadline to 30 May 2026. Organisations should not assume that future deadlines will be extended.
What a DPCO is
A DPCO is an entity licensed by the NDPC to train, audit, consult and provide services that support compliance. Law firms, audit firms, consultancies and IT service providers can apply. The NDPC lists the requirements, which include qualified staff and a registered .ng website.
Advice on data protection is not restricted to DPCOs. Any organisation may get help preparing documents and fixing gaps. The licence matters when the audit return is filed and verified.
How to prepare for the next return
- Confirm your category. Check whether you are a data controller or processor of major importance and at which level.
- Gather evidence during the year, not in March. Keep your records of processing, policies, training records and any breach log up to date.
- Review your contracts with processors and partners.
- Run a gap assessment early enough to fix what it finds.
- Choose your DPCO in good time, and make sure it is licensed by the NDPC.
How SafeDaTech helps
We help organisations prepare the evidence a compliance audit return needs: data mapping, policies, impact assessments, training and remediation. Filing and verification are completed by a licensed DPCO. We tell you plainly which parts we deliver and which a licensed partner completes.
This article is general information, not legal advice. Check current requirements and deadlines with the NDPC.