NDPA explorer

The Act aims to safeguard the fundamental rights and freedoms of data subjects under the 1999 Constitution, regulate processing of personal data, promote secure processing, ensure fair, lawful and accountable processing, protect data subjects’ rights and provide remedies, ensure controllers and processors fulfil their obligations, establish an independent Commission, and strengthen the legal foundations of the digital economy.

Part I: Objectives and Application

The Act applies to the processing of personal data, whether by automated means or not.

Part I: Objectives and Application

The Act applies where (a) the controller or processor is domiciled in, resident in, or operating in Nigeria; (b) the processing occurs within Nigeria; or (c) the controller or processor is not in Nigeria but processes personal data of a data subject in Nigeria.

Part I: Objectives and Application

The Act does not apply to processing carried out solely by one or more persons for personal or household purposes, provided the processing does not violate the data subject’s fundamental right to privacy.

Part I: Objectives and Application

Subject to constitutional rights and limitations, the Part V obligations, other than sections 24, 25, 32 and 40, do not apply where processing is (a) by a competent authority for prevention, investigation, detection, prosecution or adjudication of crime or executing a criminal penalty; (b) by a competent authority for preventing or controlling a national public health emergency; (c) by a competent authority as necessary for national security; (d) for publication in the public interest for journalism, educational, artistic and literary purposes, to the extent the obligations are incompatible with those purposes; or (e) necessary for establishing, exercising or defending legal claims.

Part I: Objectives and Application

The Commission may by regulation prescribe further types of personal data and processing to be exempted, and may issue a guidance notice with safeguards and best practices for exempted processing that violates or is likely to violate sections 24 and 25.

Part I: Objectives and Application

The Commission regulates technological and organisational measures for personal data protection, registers data controllers and processors of major importance, may accredit, license and register providers of data protection compliance services, receives complaints, promotes awareness, determines adequacy of countries, sectors, binding corporate rules, contractual clauses, codes of conduct and certification mechanisms for cross-border transfers, and collects and publishes information on personal data breaches.

Part II: Establishment of the Commission

The Commission oversees implementation of the Act, prescribes fees, issues regulations, rules, directives and guidance, and prescribes the manner, frequency and content of compliance returns by data controllers and processors of major importance.

Part II: Establishment of the Commission

Personal data must be processed in a fair, lawful and transparent manner.

Part V: Principles and Lawful Basis Governing Processing of Personal Data

Personal data must be collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes.

Part V: Principles and Lawful Basis Governing Processing of Personal Data

Personal data must be adequate, relevant and limited to the minimum necessary for the purposes for which it was collected or further processed.

Part V: Principles and Lawful Basis Governing Processing of Personal Data

Personal data must be retained for no longer than is necessary to achieve the lawful bases for which it was collected or further processed.

Part V: Principles and Lawful Basis Governing Processing of Personal Data

Personal data must be accurate, complete, not misleading and, where necessary, kept up to date having regard to the purposes for which it is collected or further processed.

Part V: Principles and Lawful Basis Governing Processing of Personal Data

Personal data must be processed in a manner that ensures appropriate security, including protection against unauthorised or unlawful processing, access, loss, destruction, damage or any form of data breach.

Part V: Principles and Lawful Basis Governing Processing of Personal Data

Controllers and processors must use appropriate technical and organisational measures to ensure confidentiality, integrity and availability of personal data. Notwithstanding any other law, a controller or processor owes a duty of care in respect of processing and must demonstrate accountability in respect of the principles in the Act.

Part V: Principles and Lawful Basis Governing Processing of Personal Data

Compatibility of further processing is assessed by considering the relationship between the original and intended purposes, the nature of the data, the consequences of further processing, how the data was collected, and the existence of appropriate safeguards. Further processing for archiving in the public interest, scientific, historical research or statistical purposes is not considered incompatible with the initial purposes.

Part V: Principles and Lawful Basis Governing Processing of Personal Data

Processing is lawful where the data subject has given and not withdrawn consent for the specific purpose or purposes for which the data is to be processed.

Part V: Principles and Lawful Basis Governing Processing of Personal Data

Processing is lawful where necessary (i) for performance of a contract with the data subject or steps at their request before contracting; (ii) for compliance with a legal obligation; (iii) to protect the vital interests of the data subject or another person; (iv) for a task in the public interest or in the exercise of official authority; or (v) for the legitimate interests of the controller, processor or a third party to whom the data is disclosed.

Part V: Principles and Lawful Basis Governing Processing of Personal Data

Interests are not legitimate for section 25(1)(b)(v) where they override the fundamental rights, freedoms and interests of the data subject; are incompatible with the other necessity grounds in 25(1)(b)(i)-(iv); or the data subject would not have a reasonable expectation that the data would be processed in that manner.

Part V: Principles and Lawful Basis Governing Processing of Personal Data

The data controller bears the burden of proof for establishing a data subject’s consent.

Part V: Principles and Lawful Basis Governing Processing of Personal Data

In determining whether consent was freely and intentionally given, account is taken of whether performance of a contract, including provision of a service, is conditional on consent to processing of personal data that is not necessary for that contract.

Part V: Principles and Lawful Basis Governing Processing of Personal Data

Silence or inactivity of the data subject does not constitute consent.

Part V: Principles and Lawful Basis Governing Processing of Personal Data

Where processing is based on consent, the data subject must be informed of the right to withdraw consent before granting it. Withdrawal does not affect lawfulness of processing that occurred before withdrawal.

Part V: Principles and Lawful Basis Governing Processing of Personal Data

A request for consent must be in clear and simple language and an accessible format.

Part V: Principles and Lawful Basis Governing Processing of Personal Data

Consent must be in the affirmative and not based on a pre-selected confirmation. It may be provided in writing, orally or through electronic means.

Part V: Principles and Lawful Basis Governing Processing of Personal Data

Before collecting personal data directly from a data subject, the controller must inform the data subject of: (a) its identity, residence or place of business and means of communication; (b) the specific lawful basis under section 25(1) or 30(1) and the purposes; (c) recipients or categories of recipients; (d) the existence of data subject rights under Part VI; (e) the retention period; (f) the right to lodge a complaint with the Commission under section 46(1); and (g) existence of automated decision-making including profiling, its significance and consequences, and the right to object to and challenge it.

Part V: Principles and Lawful Basis Governing Processing of Personal Data

Before collecting personal data other than directly from the data subject, the controller must provide the same information, except where the data subject already has it or providing it is impossible or involves disproportionate effort or expense.

Part V: Principles and Lawful Basis Governing Processing of Personal Data

The information must be contained in a privacy policy expressed in a clear, concise, transparent, intelligible and easily accessible format, taking into consideration the class of data subjects targeted.

Part V: Principles and Lawful Basis Governing Processing of Personal Data

Where processing may likely result in high risk to the rights and freedoms of a data subject by virtue of its nature, scope, context and purposes, the controller must, prior to the processing, carry out a data privacy impact assessment.

Part V: Principles and Lawful Basis Governing Processing of Personal Data

The controller must consult the Commission prior to processing if, despite the measures envisaged, the DPIA indicates the processing would result in a high risk to the rights and freedoms of a data subject.

Part V: Principles and Lawful Basis Governing Processing of Personal Data

The Commission may make regulations or issue directives on the section, including the categories of processing and persons subject to the DPIA requirement.

Part V: Principles and Lawful Basis Governing Processing of Personal Data

A DPIA is a process to identify the risks and impact of envisaged processing. It comprises (a) a systematic description of the processing and its purpose, including any legitimate interest pursued; (b) an assessment of the necessity and proportionality of the processing in relation to its purposes; (c) an assessment of the risks to the rights and freedoms of data subjects; and (d) the measures envisaged to address the risks, including safeguards, security measures and mechanisms to protect personal data, taking into account the rights and legitimate interests of data subjects and others concerned.

Part V: Principles and Lawful Basis Governing Processing of Personal Data

A controller (or processor) that engages a processor must ensure the processor: (a) complies with the principles and obligations in the Act as applicable to the controller; (b) assists, through appropriate technical and organisational measures, in honouring data subject rights under Part VI; (c) implements appropriate security measures as required by Part VII; (d) provides the information reasonably required to comply and demonstrate compliance; and (e) notifies the engaging party when a new data processor is engaged.

Part V: Principles and Lawful Basis Governing Processing of Personal Data

The measures under section 29(1) include a written agreement between the controller and the processor, or between processors.

Part V: Principles and Lawful Basis Governing Processing of Personal Data

Sensitive personal data must not be processed unless: (a) the data subject has given and not withdrawn consent for the specific purposes; (b) it is necessary to perform obligations or exercise rights under employment or social security laws; (c) it is necessary to protect vital interests where the data subject is physically or legally incapable of consent; (d) it is carried out in the legitimate activities of a non-profit body with appropriate safeguards, relating solely to its members or persons in regular contact, without disclosure outside the entity absent explicit consent; (e) it is necessary for legal claims, obtaining legal advice or legal proceedings; (f) it is necessary for substantial public interest on the basis of a proportionate law with suitable safeguards; (g) it is for medical care or community welfare by or under a professional owing a duty of confidentiality; (h) it is necessary for public health with suitable safeguards; or (i) it is necessary for archiving in the public interest or historical, statistical or scientific research on the basis of a proportionate law with suitable safeguards.

Part V: Principles and Lawful Basis Governing Processing of Personal Data

The Commission may prescribe further categories of sensitive personal data, further grounds for processing and safeguards, having regard to the risk of significant harm, the reasonable expectation of confidentiality and the adequacy of protection afforded generally.

Part V: Principles and Lawful Basis Governing Processing of Personal Data

Where the data subject is a child or a person lacking legal capacity to consent, the controller must obtain the consent of the parent or legal guardian to rely on consent. The controller must apply appropriate mechanisms to verify age and consent, taking available technology into account. Presentation of any government-approved identification document is an appropriate mechanism.

Part V: Principles and Lawful Basis Governing Processing of Personal Data

Parental or guardian consent under section 31(1) does not apply where processing is necessary to protect the vital interests of the child or person lacking capacity; carried out for education, medical or social care by or under a professional owing a duty of confidentiality; or necessary for court proceedings relating to the individual.

Part V: Principles and Lawful Basis Governing Processing of Personal Data

For a child aged 13 and above in relation to information and services by electronic means at the specific request of the child, the Commission shall make regulations in accordance with the Act’s objectives. Nothing in the Act authorises processing of a child’s data in a manner inconsistent with the Child’s Rights Act. “Child” has the meaning in the Child’s Rights Act, No. 26 of 2003.

Part V: Principles and Lawful Basis Governing Processing of Personal Data

A data controller of major importance must designate a Data Protection Officer with expert knowledge of data protection law and practices and the ability to carry out the tasks prescribed under the Act and subsidiary legislation. The DPO may be an employee or engaged by a service contract.

Part V: Principles and Lawful Basis Governing Processing of Personal Data

The DPO must advise the controller or processor and their employees who carry out processing, monitor compliance with the Act and related policies, and act as the contact point for the Commission on processing issues.

Part V: Principles and Lawful Basis Governing Processing of Personal Data

The Commission may license persons with requisite expertise to monitor, audit and report on compliance by controllers and processors with the Act and with regulations, guidelines, directives and codes of conduct issued under it.

Part V: Principles and Lawful Basis Governing Processing of Personal Data

A data subject may obtain from the controller, without constraint or unreasonable delay, confirmation of whether the controller or a processor on its behalf is processing their personal data and, if so: the purposes, categories of data, recipients (particularly in third countries), the storage period or criteria, the existence of rights to rectification, erasure, restriction and objection, the right to complain to the Commission, the source of data not collected from the data subject, and the existence of automated decision-making including profiling and its significance.

Part VI: Rights of a Data Subject

A data subject may obtain a copy of their personal data in a commonly used electronic format, except to the extent that providing it would impose unreasonable costs on the controller, in which case the data subject may be required to bear some or all of the costs.

Part VI: Rights of a Data Subject

A data subject may obtain correction or, if correction is not feasible or suitable, deletion of personal data that is inaccurate, out of date, incomplete or misleading.

Part VI: Rights of a Data Subject

A data subject may obtain erasure of their personal data without undue delay. The controller must erase personal data without undue delay where the data is no longer necessary for the purposes for which it was collected or processed, or the controller has no other lawful basis to retain it.

Part VI: Rights of a Data Subject

A data subject may obtain restriction of processing pending resolution of a request, an objection by the data subject, or the establishment, exercise or defence of legal claims.

Part VI: Rights of a Data Subject

A data subject has the right to withdraw consent at any time, and the controller must ensure it is as easy to withdraw as to give consent.

Part VI: Rights of a Data Subject

A data subject has the right to object to processing of their personal data. The controller must discontinue processing unless it demonstrates a public interest or other legitimate grounds that override the fundamental rights, freedoms and interests of the data subject.

Part VI: Rights of a Data Subject

Where personal data is processed for direct marketing, including related profiling, the data subject may object at any time, and the data must then no longer be processed for that purpose.

Part VI: Rights of a Data Subject

A data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal or similarly significant effects. This does not apply where the decision is necessary for entering into or performing a contract, authorised by a written law with suitable safeguards, or authorised by the data subject’s consent.

Part VI: Rights of a Data Subject

Where automated decision-making is permitted, the controller must implement suitable safeguards including the rights to obtain human intervention, to express the data subject’s point of view, and to contest the decision.

Part VI: Rights of a Data Subject

The Commission may make regulations establishing a right of data portability. That right would entitle the data subject to receive their data in a structured, commonly used and machine-readable format, transmit it to another controller without hindrance, and where technically possible have it transmitted directly between controllers. The Commission may prescribe conditions, obligations, costs and timing.

Part VI: Rights of a Data Subject

Controllers and processors must implement appropriate technical and organisational measures to ensure the security, integrity and confidentiality of personal data, including protection against accidental or unlawful destruction, loss, misuse, alteration, unauthorised disclosure or access, taking into account the amount and sensitivity of the data, the nature, degree and likelihood of harm, the extent of processing, the retention period, and the availability and cost of measures relative to the size of the organisation.

Part VII: Data Security

Measures may include pseudonymisation or de-identification; encryption; processes to ensure security, integrity, confidentiality, availability and resilience of systems; processes to restore availability and access to data after a physical or technical incident; periodic risk assessments; regular testing and evaluation of measures; and regular updating of measures to address shortcomings and evolving risks.

Part VII: Data Security

Where a breach occurs in data stored or processed by a data processor, the processor must, on becoming aware, notify the controller or processor that engaged it, describing the nature of the breach including, where possible, the categories and approximate numbers of data subjects and records concerned, and respond to that party’s information requests.

Part VII: Data Security

A data controller must, within 72 hours of becoming aware of a breach likely to result in a risk to the rights and freedoms of individuals, notify the Commission and, where feasible, describe the nature of the breach including the categories and approximate numbers of data subjects and records concerned.

Part VII: Data Security

Where a breach is likely to result in a high risk to the rights and freedoms of a data subject, the controller must immediately communicate it to the data subject in plain and clear language, including advice on measures the data subject can take to mitigate adverse effects. If direct communication would involve disproportionate effort or expense or is not feasible, a public communication in widely used media may be made instead.

Part VII: Data Security

Notifications and communications must also state the name and contact details of a point of contact, describe the likely consequences of the breach, and describe the measures taken or proposed to address it, including measures to mitigate adverse effects.

Part VII: Data Security

The Commission may make a public communication about a notified breach if it considers the controller’s steps to inform data subjects inadequate, and will publish regulations on adequately informing data subjects. In evaluating risk, the controller and the Commission may consider the likely effectiveness of technical and administrative mitigation measures (including encryption or de-identification), subsequent mitigation, and the nature, scope and sensitivity of the data.

Part VII: Data Security

Controllers and processors must keep a record of all personal data breaches, comprising the facts, effects and remedial action, in a manner enabling the Commission to verify compliance. Where information cannot be provided all at once, it may be provided in phases without undue delay.

Part VII: Data Security

Personal data must not be transferred from Nigeria to another country unless (a) the recipient is subject to a law, binding corporate rules, contractual clauses, code of conduct or certification mechanism that affords an adequate level of protection in accordance with the Act; or (b) one of the conditions in section 43 applies.

Part VIII: Cross-Border Transfers of Personal Data

The controller or processor must record the basis for the transfer and the adequacy of protection under section 42. The Commission may make regulations requiring notification of transfer measures and an explanation of their adequacy, and may designate categories of data subject to additional transfer restrictions.

Part VIII: Cross-Border Transfers of Personal Data

A level of protection is adequate if it upholds principles substantially similar to the conditions for processing in the Act. Assessment takes into account enforceable data subject rights and redress and the rule of law, any instrument between the Commission and the recipient jurisdiction’s authority, public authority access to data, the existence of an effective data protection law, an independent supervisory authority with enforcement powers, and binding international commitments and memberships.

Part VIII: Cross-Border Transfers of Personal Data

The Commission issues guidelines on adequacy assessment and may determine whether a country, region, sector or standard contractual clauses afford adequate protection, and may approve binding corporate rules, codes of conduct and certification mechanisms. The absence of a determination does not imply adequacy. The Commission may base a determination on adequacy decisions of other competent authorities that considered similar factors.

Part VIII: Cross-Border Transfers of Personal Data

In the absence of adequacy, personal data may be transferred only if (a) the data subject has consented after being informed of the possible risks due to absence of adequate protections; (b) the transfer is necessary for performance of a contract with the data subject or pre-contract steps at their request; (c) the transfer is for the sole benefit of the data subject, obtaining consent is not reasonably practicable and the data subject would likely give it; (d) it is necessary for important reasons of public interest; (e) it is necessary for legal claims; or (f) it is necessary to protect vital interests where the data subject is physically or legally incapable of consent.

Part VIII: Cross-Border Transfers of Personal Data

No specific international or multinational cross-border transfer codes, rules or certification mechanisms may be adopted as a Nigerian standard for protection of data subjects or data sovereignty without National Assembly approval.

Part VIII: Cross-Border Transfers of Personal Data

Data controllers and processors of major importance must register with the Commission within six months after commencement of the Act or on becoming a controller or processor of major importance.

Part IX: Registration and Fees

Registration requires notifying the Commission of: name and address of the controller or processor and of its DPO; a description of the personal data and the categories and number of data subjects; the purposes; categories of recipients; the name and address of any processor acting on its behalf; countries to which data is or may be transferred; a general description of risks, safeguards and security measures; and any other information required by the Commission.

Part IX: Registration and Fees

A registered entity must notify the Commission of any significant change to the registered information within 60 days. The Commission maintains and publishes a register of registered entities, removes those that notify they have ceased to be of major importance, and may exempt a class of entities from registration where it considers it unnecessary or disproportionate.

Part IX: Registration and Fees

The Commission may prescribe fees or levies payable by data controllers and processors of major importance.

Part IX: Registration and Fees

A data subject aggrieved by the decision, action or inaction of a controller or processor in violation of the Act or subsidiary legislation may lodge a complaint with the Commission. The Commission may investigate complaints that are not frivolous or vexatious and may initiate investigations of its own accord where it has reason to believe there is or is likely to be a violation.

Part X: Enforcement

For an investigation the Commission may order a person to attend for oral examination, produce documents, records or articles, furnish a written statement under oath or affirmation, or give access for inspection of stored material in a visible, legible, structured, commonly used and machine-readable format. It may make representations to either party on behalf of the other, and must establish a unit to receive and follow up on complaints and conduct investigations.

Part X: Enforcement

Where the Commission is satisfied that a controller or processor has violated or is likely to violate the Act or subsidiary legislation, it may make a compliance order, including a warning, a requirement to comply (including with data subject requests), or a cease and desist order, including an order to stop processing. The order must be in writing and specify the provisions violated, the measures required, the period to implement them and the right to judicial review under section 50.

Part X: Enforcement

After investigation, if satisfied that a violation occurred, the Commission may make an enforcement order or impose a sanction, and must inform the controller or processor and any complainant in writing. Orders may require the violation to be remedied, compensation to a data subject who suffered injury, loss or harm, an account of profits realised from the violation, or payment of a penalty or remedial fee.

Part X: Enforcement

A penalty or remedial fee may be up to the higher maximum amount for a controller or processor of major importance, being the greater of ₦10,000,000 and 2% of annual gross revenue in the preceding financial year; or the standard maximum amount for one not of major importance, being the greater of ₦2,000,000 and 2% of annual gross revenue in the preceding financial year.

Part X: Enforcement

In determining sanctions the Commission considers the nature, gravity and duration of the infringement; the purpose of processing; the number of data subjects involved; the level of damage and mitigation measures implemented; intent or negligence; the degree of cooperation with the Commission; and the types of personal data involved.

Part X: Enforcement

A controller or processor that fails to comply with an order under section 47 commits an offence and is liable on conviction to a fine up to the higher maximum amount (major importance) or the standard maximum amount, or to imprisonment for not more than one year, or both.

Part X: Enforcement

A person not satisfied with an order of the Commission may apply to the court for judicial review within 30 days after the order was made.

Part X: Enforcement

A data subject who suffers injury, loss or harm as a result of a violation of the Act by a controller or processor may recover damages in civil proceedings.

Part X: Enforcement

A court may make an order of forfeiture against a convicted controller, processor or individual in accordance with the Proceeds of Crime (Recovery and Management) Act.

Part X: Enforcement

Where an offence is committed by a body corporate or firm, the body corporate or firm and its principal officers are deemed culpable, unless the principal officers prove the offence was committed without their consent or connivance and that they exercised diligence to prevent it.

Part X: Enforcement

A data controller and data processor is vicariously liable for the acts or omissions of its agents or employees, in so far as they relate to its business.

Part X: Enforcement

The Commission’s regulation-making power extends to the frequency of filing and content of compliance returns by data controllers and processors of major importance.

Part XII: Miscellaneous Provisions

The Commission may make regulations for carrying out its objectives under the Act, including on the protection of personal data and data subjects, procedures for complaints, the forms of applications, fees, fines and charges. Regulations may create offences and impose penalties not more than those prescribed in the Act, and the Commission may publish draft regulations for comment.

Part XII: Miscellaneous Provisions

The Commission may, where necessary, issue directives, codes or guidelines on the conduct of its business and operations, its budgeting and expenditure, its governance code and any other matter relevant to its operations.

Part XII: Miscellaneous Provisions

Where any other law, in so far as it relates directly or indirectly to processing of personal data, is inconsistent with the Act, the Act prevails.

Part XII: Miscellaneous Provisions

Orders, rules, regulations, decisions, directions, licences, authorisations, registrations and other documents made or issued by NITDA or the Nigeria Data Protection Bureau before the Act continue in effect as if made by the Commission until they expire or are repealed, replaced or altered.

Part XII: Miscellaneous Provisions

“Personal data” means any information relating to an identified or identifiable individual, directly or indirectly, by reference to an identifier such as a name, identification number, location data, an online identifier or factors specific to their physical, physiological, genetic, psychological, cultural, social or economic identity. “Processing” means any operation on personal data, such as collection, recording, organisation, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure, dissemination, alignment, combination, restriction, erasure or destruction, and does not include the mere transit of data originating outside Nigeria.

Part XII: Miscellaneous Provisions

“Data controller” means an individual, private entity, public authority or other body that alone or jointly determines the purposes and means of processing. “Data processor” means one that processes on behalf of or at the direction of a controller or another processor. “Data subject” means an individual to whom personal data relates. A controller or processor “of major importance” is one domiciled, resident or operating in Nigeria that processes or intends to process personal data of more than the number of data subjects the Commission may prescribe, or a class the Commission designates as processing data of particular value or significance to the economy, society or security of Nigeria.

Part XII: Miscellaneous Provisions

“Sensitive personal data” means personal data relating to genetic and biometric data for the purpose of uniquely identifying a natural person, race or ethnic origin, religious or similar beliefs, health status, sex life, political opinions or affiliations, trade union memberships, and other information prescribed by the Commission under section 30(2). “Personal data breach” means a breach of security leading to or likely to lead to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. “Consent” means any freely given, specific, informed and unambiguous indication, by written or oral statement or affirmative action, of an individual’s agreement to the processing of personal data.

Part XII: Miscellaneous Provisions

The General Application and Implementation Directive (GAID) 2025 requires data controllers and processors of major importance in the higher classification levels to file an annual compliance audit return with the Commission, by 31 March each year for entities established before 12 June 2023; newer entities file within 15 months of establishment and annually thereafter (Article 10).

Subsidiary instrument: GAID 2025

Subsidiary instrument. Confirm the deadline and who must file against the official GAID text and current NDPC notices.

The GAID 2025 (Article 28) lists categories of processing that require a DPIA, including evaluation or scoring (profiling), automated decision-making with legal effects, systematic monitoring, sensitive or highly personal data, vulnerable data subjects, innovative technologies, digital financial services, healthcare, e-commerce, surveillance cameras, education records, hospitality and cross-border transfers.

Subsidiary instrument: GAID 2025

Subsidiary instrument. Confirm the exact list against the official GAID text.

The GAID 2025 (Article 8) classifies controllers and processors of major importance into Ultra-High Level, Extra-High Level and Ordinary-High Level, with numerical thresholds set in the GAID schedules.

Subsidiary instrument: GAID 2025

Thresholds are set out in the GAID schedules. Check the current official schedule before relying on any number.

The GAID 2025 (Articles 7 and 19) requires cookie notices to be conspicuous and obvious, treats a notice tucked away at the bottom of a page as lacking transparency, exempts strictly necessary cookies from tick-box choice, and requires a clear yes or no choice for non-necessary cookies.

Subsidiary instrument: GAID 2025

Subsidiary instrument. Confirm wording against the official GAID text.