Nigeria NDPR Cookie Consent and Compliance
The Nigeria Data Protection Regulation (NDPR) requires websites and digital platforms that collect personal data to obtain clear, informed consent from users—especially for cookies that track behavior. Cookie consent banners must be explicit, provide users with choices, and comply with NDPR principles such as data minimization and transparency.
What your business needs to know about the NDPR
The NDPR is the Nigerian framework for data protection, established in 2019 by the National Information Technology Development Agency (NITDA). It aims to safeguard the rights of natural persons to data privacy, regulate the processing of personal data, and ensure organizations handle data responsibly and transparently.
What does NDPR compliance require?
Businesses must understand that the NDPR applies to any organization—whether based in Nigeria or abroad—that processes the personal data of Nigerian residents. It mandates data protection policies, user consent for data collection, employee training, and the appointment of a Data Protection Officer (DPO) where applicable. Compliance not only avoids penalties but also builds consumer trust.
Businesses operating online in Nigeria must implement technical and organizational measures to ensure data privacy and user consent.
To check your NDPR compliance:
Review data practices:
Assess whether your organization collects, stores, processes, or shares personal data of individuals in Nigeria
Update privacy policy:
Review your privacy policy, data processing practices, and cookie consent mechanisms
Audit:
Perform an audit or gap assessment to help identify non-compliant areas and guide remediation steps
Implement consent management:
Platforms like CookieHub provide an easy way to manage consumer consent for data processing.
Who needs to comply with the NDPR?
All public and private organizations that process personal data of Nigerian citizens or residents must comply with the NDPR. This includes local companies, international businesses targeting Nigerian users, government agencies, educational institutions, and nonprofits.
Consumer rights under the NDPR
Nigeria’s law gives residents a set of data privacy rights, including:
Right to access
Request access to their personal information
Right to be informed
Request to know how personal data is being collected and used
Right to correction
Request that inaccurate, incomplete or out-of-date information be corrected
Right to deletion
Request the erasure of their personal information under certain circumstances
Right to object to or limit processing of data
Request to opt out of processing of their data
Right to data portability
Request data in a structured, commonly used format
Right to object to automated decision-making
Request that decisions not be made solely on automated processing
Right to consent
Organizations must obtain consumer consent before processing data and consumers can withdraw consent
Right to report to supervisory authority
File complaints in the event of a data breach
Why cookies as part of NDPR compliance
Cookies that collect or store personal data—such as IP addresses, device identifiers, or browsing history—fall under NDPR regulations. Users must be informed about the type of cookies used, their purpose, and must be given the option to accept or decline non-essential cookies. Default cookie acceptance is not considered valid consent under the NDPR.
Penalties for NDPR non-compliance
Non-compliance with the NDPR can lead to substantial penalties. Organizations may face fines of up to 2% of annual gross revenue or ₦10 million—whichever is greater—for serious breaches. Additional consequences may include public sanctions, reputational damage, or even suspension of data processing rights.
How to comply with the NDPR
Implementing a few key data privacy best practices can help you comply with NDPR:
Conduct data and cookie audits:
Review current data practices to identify areas for aligning with the NDPR
Update privacy and cookie policies:
Revise privacy notices to clearly outline data practices, consumer rights, and how to exercise those rights
Implement consent management:
Manage cookie use and consent with a comprehensive consent management platform like CookieHub
Educate employees:
Give employees training on the importance of compliance with NDPR
Implement breach processes:
Ensure clear pathways for notifying consumers about data breaches
Assign a privacy officer:
Add a privacy officer to your organization to manage compliance
Frequently Asked Questions
The NDPR applies to all transactions intended for the processing of personal data of Nigerian citizens and residents, whether by individuals or organizations within Nigeria or outside the country, provided the data subjects are in Nigeria.
Personal data refers to any information relating to an identified or identifiable natural person. This includes names, addresses, phone numbers, email addresses, and any other data that can be used to identify an individual.
Sensitive data includes information such as a person’s race, ethnic origin, political opinions, religious or philosophical beliefs, health status, genetic or biometric data, sexual orientation, or trade union membership.
The Nigeria Data Protection Commission (NDPC) is the regulatory authority responsible for enforcing and overseeing compliance with the NDPR.
The NDPR does not apply to purely personal or household activities with no connection to a professional or commercial purpose. Additionally, data processed for national security or public interest by authorized government agencies may be exempt under specific legal conditions.
You can find detailed information, official guidelines, and updates on the NDPR by visiting the Nigeria Data Protection Commission’s official website.
Last updated:
Disclaimer: The information provided on this page is for general reference purposes only and is not intended to constitute legal or regulatory advice. Data privacy regulations are complex and subject to frequent updates, interpretations, and jurisdictional variations. While efforts are made to keep the material accurate and up to date, we cannot guarantee its completeness or applicability to your specific circumstances. For guidance on compliance or legal obligations, please consult qualified legal professionals or the appropriate regulatory authorities.
