Frameworks · GAID 2025 · issued 20 Mar 2025
Your tier is not your size. It is a schedule.
The General Application and Implementation Directive decides who counts as a controller of major importance, and at which of three levels. Sector first, volume second — and the fee follows the tier, not the revenue.
OHL
More than 200, up to 1,000
Ordinary high level. No annual return is due at this level — Art. 9(3) asks you to renew the registration every year in its place, and the registers are still required. Registration ₦10,000, renewed every year.
EHL
More than 1,000, up to 5,000
Extra high level. A licensed DPCO must file for you. Registration ₦100,000, filing fee ₦100,000 to ₦250,000, by data subject count (Schedule 10).
UHL
More than 5,000
Ultra high level. A licensed DPCO must file. Registration ₦250,000, filing fee ₦500,000 to ₦1m, by data subject count (Schedule 10).
Sector overrides volume
Thirteen sectors are named, whatever their headcount
If the Directive names your sector, the volume test never runs. A two-person clinic and a national hospital group are both inside — which is the part most small companies get wrong.
Two hundred data subjects in six months brings you inside the regime regardless of sector. That is a low line, and it is meant to be.
- Aviation
- Communication
- Education
- Electric power
- Export and import
- Financial
- Health
- Hospitality
- Insurance
- Oil and gas
- Tourism
- E-commerce
- Public service
- + commercial ICT services on any device that stores personal data
The 6 factors
Any 4 of these 6 and you are ultra high level
Each factor is a question you can answer about yourself and argue with a regulator about — which a sector label is not. Asiri records your answer and the reason for it, so the tier is defensible rather than asserted.
Holds sensitive personal data
¶2(2)(a) — the sensitivity of the personal data in your care.
Holds data-driven financial assets for data subjects
¶2(2)(b) — assets entrusted to you by the people whose data you hold.
Relies on third-party servers or cloud services
¶2(2)(c) — where the processing done on them is substantial.
Is substantially involved in cross-border data flows
¶2(2)(d) — including a cloud region outside Nigeria.
Processes more than 5,000 data subjects
¶2(2)(e) — through technology under your technical control or a service contract. A route to this level on its own as well as a factor here.
Needs international standard certification
¶2(2)(f) — for the people, processes and technologies behind confidentiality, integrity and availability.
Enough ticked here that this workspace reads as ultra high level on the factor test as well as on volume. Where the two disagree, Asiri shows both and files the reasoning.
Redline · GAID 2025, issued 20 Mar 2025
What the Directive changed, in its own words
Guidance moves, and a page that quietly rewrites itself is worse than one that shows the change. Asiri versions the thresholds, so an audit filed under the old schedule still reads as correct for its date.
Was
Controller of major importance defined largely by sector, with volume left to guidance notices.
Now
A three-level ladder in the schedule itself: ultra high, extra high and ordinary high level, each with its own duties.
Was
Filing fee described as payable, with the amount set case by case.
Now
Six amounts in Schedule 10, banded by data subject count: ₦500,000 to ₦1m at ultra high level and ₦100,000 to ₦250,000 at extra high. Art. 10(10) fixes no amount itself — it points at the schedule.
Was
Audit return due 31 March, with no stated extension mechanism.
Now
The 2025 year extended by 60 days to 30 May 2026 — an extension of that year, not a new annual deadline.
Was
DPCO involvement recommended for larger controllers.
Now
Ultra and extra high level controllers cannot file their own return at all. A licensed DPCO signs it.
Where we will not pretend
Nobody can tell us the day this Directive began to bind
GAID 2025 is signed 20 Mar 2025 and contains no commencement article. Our own document register records it as effective 19 September 2025, and no paragraph of the 117 pages says so. Every figure on this page is dated from the signature, because that is the date a reader can check — and we would rather say that than pick.
What Asiri does
Dates every GAID figure from 20 Mar 2025, the date on the Directive's own signature page, and holds the commencement question open in the rules engine with the readings written out. An audit filed under one reading stays readable under the other, because the record carries the version of the rules that produced it.
Why it matters to you
If the Directive began in September and you were audited for the first half of 2025, the schedule you were measured against may not have been in force. That is worth arguing. It is not worth being told a date we cannot show you in the document.
Settle your tier before somebody else settles it for you
Answer two questions on the pricing page and Asiri returns your tier, the statutory fees, who may sign your return, and the reasoning behind all three.