The Nigeria Data Protection Act sets real money behind a data breach, and the amount depends on the size of the organisation involved.
The two penalty bands
The Act sets what NDPC's FAQ calls the "higher maximum amount" and the "standard maximum amount". A data controller or processor of major importance faces ₦10 million or 2% of annual gross revenue, whichever is higher.
An organisation that does not carry that label faces ₦2 million or 2% of annual gross revenue, whichever is higher instead. Both figures work the same way: whichever number is larger between the fixed naira amount and the percentage of revenue applies.
Why the amount scales with revenue
A fixed fine hits a small business harder than a large one, in relative terms. Tying the penalty partly to annual gross revenue is how the Act keeps the fine meaningful for a bigger organisation too.
For a business with modest revenue, the fixed naira figure is usually the one that applies. For a much larger one, the percentage figure can end up higher.
What else NDPC can order
A fine is not the only outcome available. NDPC can also order an organisation to remedy the breach itself, pay compensation to those affected, or account for any profit made from the breach.
That combination matters more for some businesses than the fine itself. A fix-it order with a public compensation requirement can cost more in customer trust than the fine does in cash.
How this differs from the audit return penalty
Don't confuse this with the smaller penalty for a late compliance audit return. That penalty adds 50% of the CAR filing fee, on top of the fee on top of the filing fee, for missing a deadline, not for breaching the Act itself.
The two penalties address different failures: one is a paperwork deadline, the other is what happens after an actual data protection breach.
Reducing your exposure before it becomes a problem
Registering with NDPC if the major importance test applies to you is the starting point, since our guide to that test explains. A basic privacy policy that reflects what your business actually does, rather than a copied template, is the next step.
Neither one makes a breach impossible. Both put you in a stronger position if NDPC ever asks questions.
Common mistakes
- Assuming the fine is a fixed naira figure only. The percentage-of-revenue option can push the amount higher for a larger organisation.
- Treating a fine as the worst outcome. A remedy order or compensation requirement can carry its own cost.
- Mixing up this penalty with the audit return's late fee. They come from different failures, at different amounts.
- Waiting for a breach before writing a privacy policy. By then, the policy is evidence of what you weren't doing, not protection.
For the registration and audit duties that reduce this risk, see the SME regulators hub, and the compliance calendar for keeping your filings on time.