{"id":1781,"date":"2025-05-13T11:11:34","date_gmt":"2025-05-13T10:11:34","guid":{"rendered":"https:\/\/lexluminar.com\/?p=1781"},"modified":"2025-06-24T14:14:18","modified_gmt":"2025-06-24T13:14:18","slug":"navigating-the-ndpcs-general-application-and-implementation-directive-gaid-2025","status":"publish","type":"post","link":"https:\/\/lexluminar.com\/fr\/navigating-the-ndpcs-general-application-and-implementation-directive-gaid-2025\/","title":{"rendered":"Navigating the NDPC’s General Application and Implementation Directive (GAID) 2025"},"content":{"rendered":"\n

Nigeria\u2019s data protection landscape has taken a significant step forward with the introduction of the General Application and Implementation Directive (GAID)<\/strong> 2025 by the Nigeria Data Protection Commission (NDPC)<\/strong> on March 20, 2025. This directive provides practical guidelines for implementing the Nigeria Data Protection Act (NDPA<\/strong>) 2023. The GAID is a significant step toward safeguarding privacy rights, enhancing legal certainty in data practices, and supporting Nigeria\u2019s digital economy. The directive\u2019s scope encompasses individual responsibilities, cross-border data transfers and emerging technologies [1]<\/a>, providing comprehensive guidance for stakeholders.<\/p>\n\n\n\n

Highlights of GAID 2025<\/h3>\n\n\n\n

1. Legal Reach and Data Subject Rights<\/strong><\/p>\n\n\n\n

The GAID affirms that data protection rights extend beyond borders<\/strong>, applying not only to Nigerian residents but also to anyone whose personal data is processed within Nigeria\u2019s jurisdiction regardless of their nationality and residency status. Even Nigerian citizens abroad may be protected under certain conditions [2]<\/a>. Article 2 of the GAID further underscores the significance of personal data as a key element in governance and national development, identifying critical sectors such as immigration, finance, healthcare, and education where data protection is essential, thus establishing the NDPA as a unifying federal authority on privacy. [3]<\/a><\/p>\n\n\n\n

2. Cancellation of the Nigeria Data Protection Regulation (NDPR) 2019<\/strong><\/p>\n\n\n\n

To avoid fragmentation in data regulation, Article 3 declares the NDPA the prevailing legal standard<\/strong> in cases of conflict with other laws.[4]<\/a> It also formally retires the 2019 Nigeria Data Protection Regulation (NDPR). However, all actions taken under the NDPR before the issuance of GAID, remain valid. This includes annual audit returns filed prior to the release of GAID.<\/p>\n\n\n\n

3. Duties of Data Controllers and Processors<\/strong><\/p>\n\n\n\n

The GAID places heavy emphasis on compliance and accountability<\/strong>. It requires entities handling personal data to:<\/p>\n\n\n\n

    \n
  1. Register with the NDPC.<\/li>\n\n\n\n
  2. Appoint Data Protection Officers (DPOs).<\/li>\n\n\n\n
  3. Conduct regular audits and submit reports.<\/li>\n\n\n\n
  4. Publish transparent privacy policies.[5]<\/a><\/li>\n<\/ol>\n\n\n\n

    <\/p>\n\n\n\n

    Non compliance with these requirements can lead to administrative penalties. The GAID requires DPO\u2019s to:<\/p>\n\n\n\n

      \n
    1. Submit semi-annual reports<\/strong><\/li>\n\n\n\n
    2. Undergo credential assessments<\/li>\n\n\n\n
    3. Ensure internal privacy training.[6]<\/a><\/li>\n<\/ol>\n\n\n\n

      <\/p>\n\n\n\n

      These measures institutionalize a culture of privacy and encourage proactive risk management.<\/p>\n\n\n\n

      4. Principles and Lawful Bases of Data Processing<\/strong><\/p>\n\n\n\n

      Central to the directive are the eight core principles of data protection<\/strong>, including fairness, transparency, purpose limitation, and accountability.[7]<\/a> The GAID outlines six lawful bases for processing data<\/strong>:<\/p>\n\n\n\n

        \n
      1. Consent<\/li>\n\n\n\n
      2. Contract<\/li>\n\n\n\n
      3. Legal obligation<\/li>\n\n\n\n
      4. Vital interest<\/li>\n\n\n\n
      5. Public interest<\/li>\n\n\n\n
      6. Legitimate Interest [8]<\/a> <\/li>\n<\/ol>\n\n\n\n

        <\/p>\n\n\n\n

        The GAID stresses the importance of informed consent and offers guidance for situations where implied consent may be acceptable.[9]<\/a> It further provides detailed criteria for consent in the use of cookies on websites, marketing, and sensitive data handling.[10]<\/a><\/p>\n\n\n\n

        5. Risk Assessment and Emerging Technologies<\/strong><\/p>\n\n\n\n

        The GAID mandates Data Privacy Impact Assessment (DPIA)<\/strong> for high-risk data activities, especially where new technologies or large-scale processing of personal data is involved.[11]<\/a> It lists sectors such as healthcare, finance, education, hospitality and e-commerce as priorities for DPIA. The framework also considers cross-border data flows<\/strong> and data ethics, providing guidance for balancing innovation with privacy.[12]<\/a><\/p>\n\n\n\n

        6. Standard Notice to Address Grievance (SNAG)<\/strong><\/p>\n\n\n\n

        <\/a>The GAID introduces a Standard Notice to Address Grievance (SNAG<\/strong>) template for data subjects to report potential data privacy breaches to data controllers or processors. This notice can be submitted via email, postal address, or courier service. The SNAG serves as an internal dispute resolution tool and is not mandatory for filing complaints directly with the Commission. Data controllers or processors who receive a SNAG must notify the Commission of their response through a designated electronic platform.<\/p>\n\n\n\n

        7. Filing of Compliance Audit Returns (\u201cCAR\u201d)<\/strong><\/p>\n\n\n\n

        Pursuant to the General Application and Implementation Directive (GAID), data controllers and processors are mandated to conduct periodic compliance audits of their data processing activities. These audits are intended to ensure the establishment and maintenance of processes and systems that implement appropriate technical and organisational measures to mitigate the risk of data breaches. Compliance audits must adopt a risk-based approach, taking into account the people, processes, and technologies engaged across the data processing value chain.<\/p>\n\n\n\n

        For Data Controllers and Processors of Major Importance (DCPMIs), the submission of Compliance Audit Returns (“CAR”) is an annual statutory obligation.<\/p>\n\n\n\n