After The Extension: A Data Protection Playbook For Banks & Fintechs
The extended deadline for the 2025 Compliance Audit Return has passed. For banks and FinTechs, the question is no longer simply whether a return was filed, but whether the data protection programme behind that filing can withstand regulatory scrutiny. Data protection compliance in Nigeria has moved beyond simply having a privacy policy or obtaining consent from customers. The Nigeria Data Protection Act 2023 (NDPA) established the Nigeria Data Protection Commission (NDPC) and created a comprehensive statutory framework for the protection of personal data. The General Application and Implementation Directive 2025 (“GAID” or “Directive”), which took effect on 19 September 2025, turned this Act into the documented, auditable programme that now governs every Data Controller and Processor of Major Importance in the country. For banks and FinTechs, data protection compliance is therefore not simply another legal or IT issue. It is a governance, operational and reputational issue that should be receiving attention across all leadership cadres.