Nigeria Data Protection Act 2023 and GAID 2025: hosting your data in the EU

A practical guide for Nigerian businesses, developers and agencies deciding where to host customer data. Status as of 30.09.2026. This is general information, not legal advice.

Short answer

  1. 1The Nigeria Data Protection Act 2023 (NDPA) is the main data protection law, and the Nigeria Data Protection Commission (NDPC) is the regulator.
  2. 2The NDPC issued the General Application and Implementation Directive (GAID) 2025 on 20 March 2025; it took effect on 19 September 2025.
  3. 3Hosting on servers in the EU is a cross-border transfer of the personal data of people in Nigeria, so you need a valid transfer basis.
  4. 4According to a DLA Piper summary of the GAID, controllers and processors relying on instruments such as standard contractual clauses or binding corporate rules must obtain the NDPC's approval. Confirm this with the NDPC before you sign.
  5. 5Responsibility stays with you as controller. A hosting provider does not certify compliance on your behalf.

What the rules say, and what we could not verify

The two instruments. The Nigeria Data Protection Act 2023 is the statute. The General Application and Implementation Directive (GAID) 2025, reference NDPC/NDP ACT-GAID/01/2025, is the NDPC's directive for applying it. The regulator published both in one document on ndpc.gov.ng, dated 20 March 2025.

Commencement. Law-firm summaries, including DLA Piper's, report a six-month transition after publication, with the GAID taking effect on 19 September 2025.

Cross-border transfers. The Act has a part on transfers of personal data outside Nigeria. According to the DLA Piper summary, the GAID sets out factors the NDPC considers for adequacy decisions without listing approved countries. It also reports that controllers and processors using transfer instruments such as binding corporate rules and standard contractual clauses must obtain the Commission's approval, and that other bases such as consent or public interest are valid only when tied to legal or fiduciary obligations.

What we did not do. The official PDF on the NDPC site refused our automated download, so we did not read the GAID text ourselves. For that reason this page gives no section numbers, no breach-notification deadline and no penalty figures. Treat the points above as a summary from a secondary source and check the original text and current NDPC guidance before you rely on them.

Real-world examples

Lagos online shop

A shop keeps customer names, phone numbers and delivery addresses in a database on a VPS in Frankfurt. It lists the EU as a destination in its records, agrees a written processing contract with the host, and asks its adviser or the NDPC which transfer basis applies.

Abuja software company

A startup runs a SaaS product for Nigerian clients on a rented server in the EU. It documents its security measures, tests restores of its backups and prepares a procedure for reporting a breach.

Agency hosting client websites

An agency in Port Harcourt hosts several client sites on one cPanel account. Each client is the controller of its visitors' data, so the agency agrees roles and responsibilities with each client in writing.

Common mistakes

  • Assuming that a server outside Nigeria takes your data outside the law. The location of the server does not decide whether the NDPA concerns you.
  • Copying a standard contractual clause template and treating it as done, without checking whether the NDPC has to approve the instrument.
  • Having no written contract with the host or processor.
  • Treating security as a one-time setup instead of testing backups, access and updates regularly.
  • Having no plan for a breach, so nobody knows who reports it, to whom, or how fast.

How 4hosting helps

Our datacenter is in the EU, in Frankfurt, not in Nigeria. We say this plainly so that you can describe the destination of your data accurately. We offer a data processing agreement (DPA) under GDPR Article 28 and standard contractual clauses for transfers. Whether a given instrument needs NDPC approval is a question for you and your adviser, not something we can decide for you.

Every plan includes monthly DevOps, CyberSecurity and Programming hours (from cPanel Advanced upwards; VPS plans include 1 to 8 hours). You can use them for server hardening, backups, access control and WAF rules. Hours are requested from the client panel and do not carry over; work beyond the included hours is accepted and billed separately. 4hosting is not a compliance certifier and does not sign legal compliance for you. Migration is free. Support is in English and Romanian.

Frequently asked questions

Is it illegal to host Nigerian personal data in the EU?

We are not aware of a ban on it, but we did not read the official text of the GAID directly, so we do not state the exact rules. A transfer needs a valid basis. Ask a Nigerian data protection lawyer or the NDPC about your case.

Where are 4hosting servers?

In the EU: Frankfurt, with points of presence in Frankfurt, London and New York. There are no 4hosting datacenters in Nigeria.

Does 4hosting make me compliant with the NDPA or GAID?

No. 4hosting does not certify legal compliance and holds no ISO, SOC 2 or similar certification; we describe our security practice as aligned with ISO 27001. We offer a data processing agreement (DPA) and standard contractual clauses, and we can help with technical hardening through the included DevOps hours. Compliance of your processing remains your responsibility.

See also

Guides for Nigerian businesses