Introduction
The Nigeria Data Protection Act, 2023 (NDPA), enacted on 12 June 2023, establishes a comprehensive framework for the protection of personal data in Nigeria and created the Nigeria Data Protection Commission (NDPC) as the regulatory authority. The General Application and Implementation Directive, 2025 (GAID), issued by the NDPC in March 2025 which became effective on the 19 September 2025, implements the NDPA by providing detailed guidance, repealing the earlier Nigeria Data Protection Regulation (NDPR) 2019, and clarifying compliance expectations.
This article examines court jurisdiction under these instruments, with a comparative analysis focusing on supremacy clauses and potential inconsistencies. It draws exclusively from the NDPA and the GAID.
COURT JURISDICTION UNDER THE NDPA
The Black Law Dictionary 9th Edition defines Jurisdiction as the court’s power to decide a matter or issue a decree. It refers to the authority of the court to adjudicate on a matter. It is also stated in the case of A.-G., Bauchi State v. A.-G., Fed (2018) 17 NWLR (Pt. 1648) 299 @ (Pp. 339-340, paras. H-B) where the Court held thus:
“Jurisdiction is the legal right or vires by which courts exercise their authority and power. Therefore, once the court has jurisdiction it is standing on a solid base or foundation as jurisdiction is the bed rock, the life wire or life blood on which a court’s proceedings are resting”.
The NDPA adopts a flexible approach to jurisdiction. Section 65 of the Nigeria Data Protection Act 2023 defines “court” simply as “any court of competent jurisdiction.” This phrasing does not designate an exclusive jurisdiction but aligns with general Nigerian jurisprudence on competent courts based on the subject matter, parties, and territorial considerations.
This open definition allows courts of competent jurisdiction including potentially Magistrate Courts in appropriate cases, subject to monetary limits and constitutional competence to adjudicate data protection claims, while reserving complex regulatory or constitutional matters for higher courts like the Federal High Court.
GAID’S ELABORATION ON JURISDICTION
Article 47 of the GAID, titled “Jurisdiction of Court and Access to Justice,” builds on the NDPA. It affirms that, without prejudice to binding court precedents, a data subject has the right to seek redress. The GAID provides that a data subject may seek redress for the violation of his or her right to privacy at the closest Federal or State High Court in line with settled precedents of the Supreme Court of Nigeria and extant Fundamental Rights Enforcement Procedure Rules.
The GAID reinforces remedies while aligning with Section 37 of the 1999 Constitution (right to privacy) and broader fundamental rights enforcement procedures.
SUPREMACY PROVISIONS
Section 63 of the NDPA 2023 contains a clear supremacy clause:
“Where provisions of any other law or enactment relating to the processing of personal data are inconsistent with the NDPA, the NDPA prevails”.
This positions the Act as the primary legislation on data protection matters.
The GAID explicitly reinforces this. In cases of conflict between any other law/regulation/guideline and the NDPA on personal data processing, the NDPA prevails. Crucially, Article 3(2) of the GAID states that if any conflict arises between the NDPA and the GAID itself, the NDPA takes precedence. The GAID thus serves as a subordinate interpretive and implementation tool.
This hierarchy ensures uniformity: the GAID cannot expand, restrict, or contradict the NDPA’s jurisdictional framework but must operate with it consistently.
Both GAID and NDPA are broadly consistent. Section 63 OF The NDPA states “any court of competent jurisdiction”, this provides flexibility, while Article 47 GAID elaborates on access to justice without narrowing or ousting jurisdiction. No direct contradiction exists here. While the NDPA is silent on exclusivity, constitutional provisions (Federal High Court’s exclusive jurisdiction in certain federal matters) and precedents may influence outcomes. GAID’s emphasis on access to justice could support arguments for broader court competence, but courts will ultimately interpret based on the Constitution and NDPA.
Section 2 of the NDPA 2023 extends to foreign entities processing Nigerian data. Jurisdiction over such entities raises private international law issues (e.g., service out of jurisdiction, enforcement of judgments), where GAID guidance on cross-border transfers applies but remains subordinate.
Overall, the framework is designed for coherence, with the GAID acting as a practical bridge rather than a competing authority.
CONCLUSION
The NDPA and GAID present a harmonious regime on court jurisdiction, anchored by clear supremacy rules that prioritize the primary legislation. The broad definition of “court” promotes access to justice while the GAID provides operational clarity without usurping legislative intent. Potential inconsistencies with other laws are resolved in favor of the NDPA, subject to constitutional limits. The GAID is a framework put in place for the implementation of the NDPA 2023.
By the provisions of the NDPA and GAID, it is clear to state that the Federal High Court and the State High Court have competent jurisdiction to entertain the matter. This is on the premise that matters in regards to Data Protection claims are related to section 37 of the Constitution of Nigeria 1999. Section 46 of the constitution provides:
“Any person who alleges that any of the provisions of this Chapter has been, is being or likely to be contravened in any State in relation to him may apply to a High Court in that State for redress”.
This evolving jurisprudence will strengthen Nigeria’s data protection ecosystem, balancing innovation, rights protection, and regulatory certainty. As with any new framework, judicial interpretation will be key to resolving ambiguities.
