The rules changed
Last updated 12 July 2026. In three years, Nigeria went from “have a privacy policy” to “show me the evidence.” This page is the timeline every compliance officer now lives on: what changed, when it changed, and what each change asks of any organisation that sends documents, collects consent, or reaches customers at scale. Every date links to its source.
June 2023: the NDPA becomes law
The Nigeria Data Protection Act 2023 creates the NDPC and puts real numbers behind data protection: registration for data controllers of major importance, and fines up to the higher of ₦10m or 2% of annual gross revenue.
What it asks of you: register, appoint accountability, and be able to show a lawful basis for every category of processing.
How Keepable answers: every consent request and processing notice delivered through Keepable carries its lawful basis in the record itself, sealed on delivery. The evidence exists because the delivery happened, not because someone remembered to file it.
March 2025: GAID is issued
The NDPC’s General Application and Implementation Directive (effective 19 September 2025) operationalises the Act. Consent must be freely given, specific, informed and unambiguous, and the annual Compliance Audit Return must show evidence that each consent was collected to standard, filed through a licensed DPCO, with fees up to ₦1m and a 50% surcharge for late filing.
What it asks of you: a checkbox screenshot will not survive a DPCO review. You need a record of what the person saw, what they decided, and when.
How Keepable answers: a Keepable consent decision is a versioned, purpose-bound record sealed on both sides, grant or decline, bound to the exact wording the person saw. The Compliance Audit Return export assembles that evidence in the Commission’s own shape.
July 2025: the fines get real
The NDPC fines MultiChoice Nigeria ₦766m for unlawful cross-border transfer and processing of personal data without consent. It remains the Commission’s largest published penalty, ahead of the ₦555.8m imposed on a commercial bank in 2024.
What it asks of you: nothing new, but it prices the risk. Two percent of gross revenue is no longer theoretical.
August 2025: the sweep
The NDPC opens investigations into 1,369 organisations in a single action, including 795 financial institutions, 392 insurance brokers and 136 gaming companies, each given 21 days to produce audit reports and evidence of compliance.
What it asks of you: the letter can arrive any morning, and the clock it starts is three weeks long.
How Keepable answers: an organisation whose consent and delivery evidence lives on the rail answers a 21-day notice with an export, not an archaeology project.
Every 31 March: audit season
Under GAID 2025, annual Compliance Audit Returns fall due on 31 March, filed through a licensed DPCO. For the 2025 audit year the NDPC extended filing to 30 May 2026; the structural deadline remains March.
What it asks of you: a repeatable, evidenced filing, every year, forever.
March 2026: the CBN retires the phone number
The CBN’s circular on instant payment functionalities and mobile banking security (12 March 2026, compliance by 1 July 2026) requires banking apps bound to one device at a time, multi-factor authentication on new devices, and liveness checks with real-time BVN or NIN validation for online account opening.
What it asks of you: stop treating a phone number as a person. The NCC recycles inactive numbers after 360 days, and the regulator has moved accordingly.
How Keepable answers: Keepable never trusted the phone number. Every delivery resolves to a verified identity anchored to the NIN, and every recipient signs in with a passkey, the same phishing-resistant, device-bound posture the CBN now mandates for banking itself.
What to do with this
If your organisation sends notices, statements, policies, offers or consent requests to Nigerians, the common thread through every entry above is evidence: of delivery, of consent, of notice. That is the product. See how the rail works, or write to sales@keepable.co and we will walk your compliance team through it.