There is more regulatory change than any team can read. The answer is not to read more. It is to know what applies to you, so that most of what arrives can be recognised as not relevant, quickly.
Monitoring and change management are different jobs. Monitoring identifies that something has changed. Change management makes sure the change is assessed, assigned, implemented and evidenced. Finding an update is not the same as complying with it.
Start with a register of obligations
List the laws, regulations, sector rules, contractual commitments and standards that apply to your organisation. For each, record what it requires in practical terms, who is responsible, and which of your controls or processes meet it. With that in hand, a new publication stops being a mystery. You can ask: does this touch anything on the register?
Assign an owner and a cadence
Someone should be responsible for watching the sources that matter: regulators’ official publications, your sector body, and your advisers. A fixed rhythm, such as a monthly review, works better than occasional scrambling.
Triage each change
For each update, ask four things. Does it apply to us? From when? What must change in our policies, controls or contracts? Who will do it, and by when? Then assess the impact: does the change affect existing controls, risk assessments, policies, contractual obligations, training requirements or reporting deadlines? Some changes need a project. Many need a note.
Keep a simple change log
Useful fields are the regulatory source, the change identified, whether it applies (yes, no or under review), the policies and controls affected, the action owner, the effective date, the status, and the evidence that it was implemented.
Record the decision, including no action
Writing down that you looked at something and decided no change was needed is useful evidence. It shows a regulator or auditor that your process works, and it saves you from repeating the analysis.
Nigeria’s data protection framework shifted when the General Application and Implementation Directive took effect on 19 September 2025 and replaced the earlier regulation. An organisation with a maintained register would see that as a clear prompt to review its policies, notices and filings against the new instrument. One without would find out later, perhaps from a client.
Consider an organisation operating in Nigeria that relies on several regulatory requirements to manage its compliance programme. Regulatory updates are monitored informally, with different departments relying on emails, industry discussions and occasional adviser updates. When a new regulatory directive is issued, the organisation takes time to establish whether it applies, which policies need updating and who is responsible for implementation. Introducing a central regulatory obligations register, assigning monitoring responsibilities and conducting scheduled reviews makes the process more structured. Instead of reacting when an auditor or client raises a question, the organisation can identify changes, assess their impact and track actions before deadlines become a problem.
