Frameworks · GAID 2025 · issued 20 Mar 2025
Understand your registration category and the records behind it.
GAID provides guidance for applying the NDPA, including classification and compliance requirements. Review your activities and the relevant schedules with your adviser before relying on a category.
OHL
More than 200, up to 1,000
Ordinary high level. No annual return is due at this level — Art. 9(3) asks you to renew the registration every year in its place, and the registers are still required. Registration ₦10,000, renewed every year.
EHL
More than 1,000, up to 5,000
Extra high level. A licensed DPCO must file for you. Registration ₦100,000, filing fee ₦100,000 to ₦250,000, by data subject count (Schedule 10).
UHL
More than 5,000
Ultra high level. A licensed DPCO must file. Registration ₦250,000, filing fee ₦500,000 to ₦1m, by data subject count (Schedule 10).
Sector overrides volume
Thirteen sectors are named, whatever their headcount
If the Directive names your sector, the volume test never runs. A two-person clinic and a national hospital group are both inside — which is the part most small companies get wrong.
Two hundred data subjects in six months brings you inside the regime regardless of sector. That is a low line, and it is meant to be.
- Aviation
- Communication
- Education
- Electric power
- Export and import
- Financial
- Health
- Hospitality
- Insurance
- Oil and gas
- Tourism
- E-commerce
- Public service
- + commercial ICT services on any device that stores personal data
The 6 factors
Any 4 of these 6 and you are ultra high level
Each factor is a question you can answer about yourself and argue with a regulator about — which a sector label is not. Asiri records your answer and the reason for it, so the tier is defensible rather than asserted.
Holds sensitive personal data
¶2(2)(a) — the sensitivity of the personal data in your care.
Holds data-driven financial assets for data subjects
¶2(2)(b) — assets entrusted to you by the people whose data you hold.
Relies on third-party servers or cloud services
¶2(2)(c) — where the processing done on them is substantial.
Is substantially involved in cross-border data flows
¶2(2)(d) — including a cloud region outside Nigeria.
Processes more than 5,000 data subjects
¶2(2)(e) — through technology under your technical control or a service contract. A route to this level on its own as well as a factor here.
Needs international standard certification
¶2(2)(f) — for the people, processes and technologies behind confidentiality, integrity and availability.
Enough ticked here that this workspace reads as ultra high level on the factor test as well as on volume. Where the two disagree, Asiri shows both and files the reasoning.
Redline · GAID 2025, issued 20 Mar 2025
What the Directive changed, in its own words
Guidance moves, and a page that quietly rewrites itself is worse than one that shows the change. Asiri versions the thresholds, so an audit filed under the old schedule still reads as correct for its date.
Was
Controller of major importance defined largely by sector, with volume left to guidance notices.
Now
A three-level ladder in the schedule itself: ultra high, extra high and ordinary high level, each with its own duties.
Was
Filing fee described as payable, with the amount set case by case.
Now
Six amounts in Schedule 10, banded by data subject count: ₦500,000 to ₦1m at ultra high level and ₦100,000 to ₦250,000 at extra high. Art. 10(10) fixes no amount itself — it points at the schedule.
Was
Audit return due 31 March, with no stated extension mechanism.
Now
The 2025 year extended by 60 days to 30 May 2026 — an extension of that year, not a new annual deadline.
Was
DPCO involvement recommended for larger controllers.
Now
Ultra and extra high level controllers cannot file their own return at all. A licensed DPCO signs it.
Dates and sources
Use the guidance that applies to the period you are reviewing.
The NDPC’s 2026 journal states that GAID was issued on 20 March 2025 and took effect on 19 September 2025. Keep the applicable version and any later guidance alongside your assessment.
Keep the source
Record which instrument and version you used when reviewing your classification or filing obligations. A publication date and an effective date serve different purposes.
Check your circumstances
For a historical filing or a change in processing, ask your adviser to confirm which requirements apply to the period. Keep that decision and its supporting source on record.
Settle your tier before somebody else settles it for you
Answer two questions on the pricing page and Asiri returns your tier, the statutory fees, who may sign your return, and the reasoning behind all three.
Primary reference: NDPC Journal 2026: GAID issue and effective dates. Review the source alongside your organisation’s circumstances.