If your business collects customer, employee or supplier information, the Nigeria Data Protection Act 2023 is relevant to you. Here is an overview of the key obligations.

Data has become one of the most valuable assets of modern business, and with that value comes responsibility. The Nigeria Data Protection Act 2023 (NDPA) provides the legal framework for the protection of personal information in Nigeria and establishes the Nigeria Data Protection Commission to regulate and enforce compliance.

Who does the Act apply to?

The Act applies to data controllers and data processors that are domiciled, resident or operating in Nigeria, to processing that takes place in Nigeria, and to the processing of personal data of data subjects in Nigeria. Put simply, if you collect, store or use personal information about people in Nigeria, you should assume the Act is relevant to you.

The core principles

Personal data must be processed in line with principles that include:

  • Lawfulness, fairness and transparency
  • Collection for specified, explicit and legitimate purposes
  • Data minimisation — collecting only what is necessary
  • Accuracy and, where necessary, keeping data up to date
  • Storage limitation — not keeping data for longer than necessary
  • Appropriate security, integrity and confidentiality
  • Accountability for compliance

Practical steps for compliance

  • Identify a lawful basis — such as consent or contractual necessity — for each type of processing.
  • Publish a clear privacy notice explaining how personal data is used.
  • Put appropriate technical and organisational security measures in place.
  • Establish a process for responding to requests from data subjects.
  • Prepare a breach response plan. Certain personal data breaches must be notified to the Commission within 72 hours of becoming aware of them.
  • Review contracts with vendors and service providers that handle personal data on your behalf.

Non-compliance can attract significant penalties and reputational damage. More importantly, respecting personal data builds the trust on which every lasting client and customer relationship depends.