Exemption From NDPC Registration Does Not Mean Exemption From Data Protection Compliance: Understanding The GAID Framework

1. Introduction

The introduction of registration requirements for certain data controllers and data processors under the General Application and Implementation Directive (GAID)¹ has significantly altered the compliance landscape of Nigeria's data protection regime. However, the registration framework has also given rise to a common misconception among organisations that fall below the prescribed registration thresholds or otherwise qualify for an exemption: namely, that exemption from registration translates into exemption from data protection obligations.

This assumption is not supported by the broader framework of the Nigeria Data Protection Act² and its Implementation Framework. While the GAID may exempt certain organisations from the obligation to register with the Nigeria Data Protection Commission (NDPC), such exemption do not automatically relieve those organisations of their substantive responsibilities as data controllers or data processors. The core principles of lawful processing, transparency, accountability, data minimisation, security, and respect for data subject rights continue to apply wherever personal data is processed.

The distinction between registration obligations and compliance obligations is particularly important for certain categories of organisations outlined in the GAID,³ small and medium-sized enterprises, startups, non-profit organisations, educational institutions, and other entities that may assume they fall outside the scope of regulatory oversight due to their exempt status. Such assumptions may expose organisations to compliance risks, regulatory scrutiny, and potential sanctions where personal data is processed in a manner that contravenes the requirements of the NDPA.

This article examines the legal effect of registration exemptions under the GAID and considers whether exempt organisations remain subject to the substantive obligations imposed by Nigeria's data protection framework. It further explores the continuing applicability of data protection principles to entities exempted from registration and highlights key compliance measures that organisations should adopt notwithstanding that exemption.

2. Categories of Organisations Exempt from NDPC Registration Under the NDPA and GAID

The obligation to register with the Nigeria Data Protection Commission (NDPC) is primarily imposed on Data Controllers and Data Processors of Major Importance (DCPMIs) under the Act.⁴ However, the Act recognises that not every organisation that processes personal data should necessarily be subjected to the registration requirement.

Accordingly, section 44(6) of the NDPA empowers the Commission to exempt certain categories of DCPMIs from registration where appropriate. In line with this provision, the Commission, through Schedule 7 of GAID, identifies specific entities that are exempt from the registration requirement.

The categories of organisations exempt from NDPC registration include:⁵

• Community-based associations;
• Faith-based organisations;
• Foreign embassies and high commissions;
• Judicial establishments or bodies performing adjudicatory functions; and
• Multigovernmental organisations.

The rationale for these exemptions appears to be linked to the unique nature, legal status, public functions, or international character of such entities. For instance, diplomatic missions may enjoy certain privileges and immunities under international law, whereas judicial bodies perform constitutionally protected adjudicatory functions that distinguish them from conventional commercial data controllers.

In addition to the expressly recognised categories, the implementation framework has clarified that certain low-risk or informal processing activities may fall outside the registration requirement. These include limited categories of traders, artisans, and informal associations whose processing activities do not constitute the type of large-scale or significant data processing contemplated for registration as Data Controllers or Data Processors of Major Importance.⁶ Nevertheless, the existence of a registration exemption should not be interpreted as removing an organisation from the scope of Nigeria's data protection framework. The exemption merely relieves the affected entity from the obligation to register with the NDPC. It does not automatically exclude the organisation from the application of the substantive provisions of the NDPA where personal data is processed.

The critical legal question therefore is whether these exempt entities remain bound by the principles and obligations governing the processing of personal data under the NDPA and the GAID. This distinction between registration obligations and compliance obligations lies at the centre of the ongoing debate regarding the legal effect of registration exemptions under Nigeria's data protection regime.

3. The Legal Effect of Registration Exemptions under the GAID.

The registration exemptions provided under the implementation framework relieve qualifying organisations from the obligation to register with the Nigeria Data Protection Commission (NDPC). The legal effect of these exemptions is therefore limited to the registration requirement itself. In other words, an exempt organisation is not required to undertake the administrative process of registration or participate in the filing obligations imposed on registrable data controllers and data processors.

However, the legal effect of the exemption should not be interpreted more broadly than intended. Neither the Act nor the GAID suggests that an organisation's exemption from registration automatically exempts it from the substantive obligations governing the processing of personal data. Registration and compliance are two distinct regulatory requirements serving different purposes. While registration facilitates regulatory oversight and accountability, compliance obligations regulate how personal data is collected, used, stored, disclosed, and protected.

Accordingly, where an exempt organisation processes personal data, it remains subject to the applicable provisions of the NDPA and other relevant regulatory instruments. Such organisations may still be required to process personal data lawfully and transparently, implement appropriate technical and organisational security measures, respect the rights of data subjects, demonstrate accountability in their processing activities and conduct Data Privacy Impact Assessment (DPIA) where applicable. Registration exemption should therefore be viewed as a procedural or administrative relief rather than a substantive exemption from data protection law. It merely removes the obligation to register with the NDPC, but it does not extinguish the duty to comply with the applicable requirements of Nigeria's data protection framework regarding lawful processing of personal data.

4. Compliance Measures Organisations Should Adopt Notwithstanding NDPC Exemption

There is currently no regulatory indication that exemption from NDPC registration shields an organisation from liability for data protection breaches. Enforcement actions by the NDPC are directed at unlawful processing activities, not necessarily registration status. A data subject who is aggrieved by the decision, action, or inaction of these exempted entities may still lodge a complaint with the Commission for investigation.⁷ Notwithstanding an organisation’s exemption from registration with the Commission under the regulatory and implementation framework, such organisations remain subject to the substantive requirements of Nigeria’s data protection law where they process personal data. Accordingly, exempt status should be understood as an administrative relief from registration obligations, rather than a blanket exemption from compliance.

Organisations benefiting from registration exemption are still expected to adopt appropriate technical and organisational measures to ensure that personal data is processed in accordance with the principles of lawful processing set out under the NDPA and GAID. Even where formal registration is not required, organisations must be able to demonstrate a lawful basis for processing personal data and ensure that data subjects are adequately informed about how their data is collected and used.⁸

In addition, exempt organisations should implement internal data governance policies that align with the principles of purpose limitation and data minimisation. Personal data should only be collected for specified, explicit, and legitimate purposes, and limited to what is necessary for those purposes. Retention practices should also be reviewed to ensure that personal data is not kept for longer than is necessary, except where retention is required by law or justified by legitimate business needs.

Security of personal data remains a core obligation regardless of registration status. Exempt organisations are expected to adopt appropriate security safeguards to protect personal data in their control against unauthorised access, loss, alteration, or disclosure. This includes both technical measures, such as access controls and encryption where appropriate, and organisational measures,⁹ such as providing ongoing training for relevant staff on data privacy requirements, as well as implementing and maintaining appropriate internal access restrictions to ensure that personal data is accessed strictly on a need-to-know basis.

Furthermore, organisations should ensure that data subject rights under the NDPA are respected. This includes the right to access personal data, the right to rectification, the right to objection in appropriate circumstances, and other rights recognised under the Act. Even where an organisation is exempt from registration, it may still be required to respond to data subject requests in a timely and lawful manner.

Importantly, exempt organisations should also consider engaging a licensed Data Protection Compliance Organisation (DPCO) for advisory support in interpreting and applying their obligations under the NDPA. While an exemption may relieve such organisations from the requirement to undergo NDPC registration processes, it does not eliminate the practical need for structured compliance oversight. A DPCO can provide guidance on the conduct of data protection audits, assist in assessing the organisation’s data processing activities, and help ensure that internal practices align with statutory requirements. This is particularly relevant in ensuring that processing activities are reviewed in line with the law and that any compliance gaps are identified and addressed proactively.

5. Why These Exempted Entities Still Require the Services of a Licensed DPCO.

Even where an organisation is exempt from NDPC registration, engaging a licensed Data Protection Compliance Organisation (DPCO) remains highly relevant. A DPCO is a licensed professional organisation approved by the Nigeria Data Protection Commission (NDPC) to provide data protection compliance services to data controllers and data processors in the private and public sectors. From the definition above, it is evident that such DPCOs are specifically positioned to assist entities in understanding and meeting their obligations under the data protection framework. Accordingly, exempt status does not negate the practical need for expert compliance support, particularly in ensuring that processing activities align with the requirements of the NDPA.

The services of a licensed Data Protection Compliance Organisation (DPCO) remain highly valuable beyond registration processes. A DPCO assists organisations in developing and documenting internal data protection policies and operational procedures in line with applicable legal requirements, as well as reviewing existing organisational documents to ensure continued compliance with the law. In addition, a DPCO serves as a key compliance partner in managing regulatory engagement, acting as a liaison between organisations and the Nigeria Data Protection Commission where necessary. They also provide critical support in responding to regulatory enquiries, audits, and compliance assessments. Ultimately, engaging a DPCO strengthens an organisation’s ability to demonstrate accountability and maintain ongoing compliance with Nigeria’s data protection framework.

A DPCO provides structured guidance on how an organisation should interpret and apply the principles of the relevant laws and regulations in practical terms. Many exempt organisations still process personal data in ways that trigger legal obligations around lawful basis, transparency, security safeguards, data subject rights, retention limits, and accountability. Without specialist support, there is a real risk that such obligations may be misunderstood or only partially implemented. The licensed organisation plays a key role in helping organisations conduct data protection audits in a structured and defensible manner. Even where an organisation is not required to file or register, it still needs to understand whether its internal practices and applicable policies align with statutory requirements. A DPCO can assess existing data processing activities, identify compliance gaps, and recommend remedial measures. This is particularly important because data protection compliance is not static; it requires continuous monitoring and periodic review as business operations evolve.¹⁰

These entities often engage third-party service providers, vendors, cloud providers, or external processors in the course of their operations. These relationships introduce additional compliance obligations, particularly around data processing agreements, due diligence, cross-border transfers, and ensuring that such third parties handle personal data in accordance with the NDPA. A DPCO provides essential guidance in structuring, reviewing, and managing these third-party relationships to ensure that data protection obligations are properly embedded in contractual and operational arrangements. In doing so, they help clearly define and allocate responsibilities between the organisation as the data controller and its service providers, including cloud infrastructure providers and other data processors, ensuring that each party’s obligations are properly understood and enforceable.

Importantly, a DPCO also assists in strengthening key contractual safeguards within third-party agreements. These typically include data protection clauses on confidentiality, purpose limitation, security standards, breach notification timelines, audit and inspection rights, sub-processing restrictions, cross-border transfer safeguards, and indemnity provisions. In particular, indemnity clauses are critical in allocating liability where a third-party processor’s non-compliance results in data breaches, regulatory sanctions, or loss suffered by data subjects or the contracting organisation. These provisions ensure that risk is not unfairly concentrated on the data controller and that there is clear accountability for failures in compliance across the data processing chain.¹¹

Conclusion

Exemption from NDPC registration under the GAID does not amount to exemption from compliance with the Nigeria Data Protection Act. While such exemptions remove the administrative obligation to register with the Commission, they do not derogate from the substantive duties imposed on data controllers and processors under the Act. The principles of lawful processing, accountability, transparency, security, and data subject rights remain fully applicable to exempt organisations. Accordingly, entities benefiting from registration exemptions must still implement appropriate governance, technical, and organisational measures to ensure compliance with applicable data protection standards. In this regard, the engagement of a licensed Data Protection Compliance Organisation (DPCO) remains a critical compliance support mechanism, especially achieved through the data privacy audit. Ultimately, registration exemption is procedural in nature, whereas compliance obligations are substantive and continuous under Nigeria’s data protection framework.

Footnotes

^{1 Schedule 7 of GAID, 2025.}

^{2  See, the Nigeria Data Protection Act, 2023.}

^{3 Schedule 7.}

^{4 Section 44.}

^{5  Ibid.}

^{6 Ibid.}

^{7  Section 46.}

^{8   Section 25.}

^{9  Section 39.}

^{10  See, Aderonke Alex-Adedipe and Olawale Atanda, ‘Compliance with Nigerian Data Protection Laws – The Role of Data Protection Compliance Organisations’ available at: (https://pavestoneslegal.com/compliance-with-nigerian-data-protection-laws-the-role-of-data-) accessed on June 1st 2026.}

^{11  See, Lex Luminar, ‘The Role of a Licensed DPCO: Ensuring Compliance and Best Practice’ available at (https://lexluminar.com/the-role-of-a-licensed-dpco-ensuring-compliance-and-best-practices/) accessed on 31st May, 2026.}

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.