Data Processing Agreement in Nigeria: Template, Key Clauses and Local Law (2026)

A data processing agreement (DPA) is the contract that governs what a service provider may do with personal data it handles on behalf of another organisation. In Nigeria, where a data controller engages a processor, the Nigeria Data Protection Act 2023 expects that relationship to be set out in a written agreement. This guide explains when you need a DPA, what the law requires, and the clauses to include. It is written for legal, privacy and procurement teams. It is general guidance, not legal advice, and you should confirm the current position with a qualified Nigerian lawyer. ## What a DPA is and when you need one Two roles matter under Nigerian data protection law. The data controller decides why and how personal data is processed. The data processor processes that data on the controller's behalf and on its instructions, for example a cloud host, a payroll provider or a marketing platform. Whenever a controller hands personal data to a processor, a DPA should govern the relationship. It can be a standalone contract or a schedule to a services agreement. Its job is to make sure the processor only does what the controller allows, and that the data stays protected. ## The law that applies in Nigeria - Nigeria Data Protection Act 2023 (NDPA). Signed in June 2023, this is the main data protection statute. It replaced the Nigerian Data Protection Regulations (NDPR) 2019 and is enforced by the Nigeria Data Protection Commission (NDPC).

• Written agreement requirement. The NDPA provides that a controller or processor that engages another processor must take measures to protect the data, including a written agreement between the parties. The controller stays responsible for ensuring its processors comply, so a weak DPA is the controller's problem too.
• General Application and Implementation Directive (GAID) 2025. The NDPC's GAID sets out the detail, including terms the processing agreement should contain, and a duty of care owed to data subjects.
• Registration. Data controllers and processors of major importance have had to register with the NDPC since 1 October 2024.
• Extra-territorial reach. The Act covers controllers and processors outside Nigeria that process the personal data of people in Nigeria, so foreign vendors are caught too. ## Key clauses to include ### Subject matter and scope Describe what personal data is processed, the categories of data subjects, the nature and purpose of the processing, and how long it lasts. This frames everything else. ### Processing only on instructions The processor must process the data only on the controller's documented instructions, and not for its own purposes. This is the core promise of a DPA. ### Confidentiality Anyone the processor allows to handle the data must be bound by confidentiality. ### Security measures Set out the technical and organisational measures the processor must maintain, such as encryption, access controls and secure storage, in line with the NDPA's security obligations. ### Sub-processors State whether the processor may engage sub-processors, that it needs the controller's authorisation, and that it must pass down the same obligations and stay responsible for them. ### Assisting the controller The processor should help the controller respond to data subject requests (such as access or deletion) and meet its own obligations, including security and breach handling. ### Breach notification Require the processor to notify the controller without undue delay after becoming aware of a personal data breach, so the controller can meet its NDPC notification duties. ### Return or deletion on exit At the end of the service, the processor must return or delete the personal data at the controller's choice, and delete existing copies, subject to any legal retention. ### Audit and cross-border transfers Give the controller a right to audit or receive evidence of compliance, and set the rules for any transfer of data outside Nigeria, which the NDPA regulates. ## A simple structure to follow 1. Parties and roles (controller and processor)

2. Details of processing (data, subjects, purpose, duration)
3. Processor obligations and instructions
4. Confidentiality
5. Security measures
6. Sub-processors
7. Assistance, data subject rights and breach notification
8. Return or deletion of data
9. Audit rights and international transfers
10. Liability and governing law ## Common mistakes to avoid - Having no written DPA at all when personal data is shared, which the NDPA expects.

• Letting the processor use the data for its own purposes without clear limits.
• Silence on sub-processors, so the chain of responsibility breaks.
• No breach notification timetable, which leaves the controller exposed to NDPC obligations.
• Forgetting the exit, so data is not returned or deleted when the service ends. ## Keeping the agreement and its obligations in one place A DPA creates obligations that run for the whole life of the service: security standards to maintain, sub-processors to track, breach timelines to meet and deletion duties at the end. These are easy to lose when the signed DPA sits in a folder while the obligations live in someone's memory. The idea behind a single AI contract workspace is to hold the agreement and its duties together: draft and review the DPA, flag the data protection obligations inside it, and track key dates and tasks in one place rather than across email and spreadsheets. Adira is one such workspace. It is built around Indian corporate law first, and support for other jurisdictions, including Nigeria, is on its roadmap, so treat the points above as a starting position to confirm with a qualified Nigerian lawyer.