Data Protection Compliance in Nigeria: What Businesses Need to Know

• Admin

A practical overview of the Nigeria Data Protection Act 2023

Personal data has become an important part of ordinary business operations. Organisations collect information from customers, employees, suppliers, website visitors and users of digital services. That information may be held in paper files, emails, customer-management systems, mobile applications and cloud platforms. The fact that information is collected for a business purpose does not remove the organisation’s legal responsibilities for handling it.

In Nigeria, the principal statutory framework is the Nigeria Data Protection Act 2023 (NDPA). The Act regulates the processing of personal data by automated and non-automated means. Its application is not confined to organisations physically based in Nigeria: it can also apply to a controller or processor outside Nigeria that processes personal data relating to a data subject in Nigeria. (Sections 1 and 2, NDPA 2023.)

1. Understand the organisation’s role

A business should first identify the personal data it collects, the people to whom the information relates, the purposes for which it is used and the parties who receive or process it. Depending on the activity, an organisation may act as a data controller, a data processor, or both in different relationships. A controller determines the purposes and means of processing, while a processor handles personal data on behalf of a controller.

This distinction is important when allocating responsibility, negotiating vendor contracts and deciding who must respond to requests from individuals or the Nigeria Data Protection Commission (NDPC).

2. Identify a lawful basis for processing

Section 25 of the NDPA recognises several lawful bases for processing personal data. They include the data subject’s consent, necessity for performing a contract or taking pre-contractual steps requested by the data subject, compliance with a legal obligation, protection of vital interests, performance of a public-interest task or official authority, and legitimate interests that are not overridden by the rights and interests of the data subject.

Consent is therefore not the only possible lawful basis for every business activity. The appropriate basis depends on the particular processing operation. Where an organisation relies on consent, the Act requires consent to be affirmative and informed; silence or inactivity does not amount to consent. A request for consent should be expressed in clear and accessible language, and the individual should be informed of the right to withdraw consent.

3. Give people clear privacy information

Section 27 requires a controller collecting personal data to provide specified information to the data subject. This includes the controller’s identity and contact details, the purpose and lawful basis of processing, recipients or categories of recipients, the rights available to the data subject, the retention period and the right to complain to the Commission.

The Act requires the relevant information to be contained in a privacy policy and expressed in a clear, concise, transparent, intelligible and easily accessible format. A privacy notice should therefore reflect the organisation’s real practices. Copying a generic notice that does not describe the business’s actual data use can create a compliance gap.

4. Respect data-subject rights

Under section 34 and related provisions, an individual may request confirmation of whether personal data is being processed and obtain information about the processing. Subject to the Act’s terms and applicable exceptions, the individual may also request access to a copy of the data, correction of inaccurate or incomplete information, erasure, or restriction of processing in specified circumstances.

The Act also addresses withdrawal of consent, objection to processing (including direct marketing), certain decisions based solely on automated processing, and data portability. Businesses should establish a process for receiving, verifying, recording and responding to such requests within the applicable legal requirements.

5. Put appropriate security and retention controls in place

Section 24 requires personal data to be processed fairly, lawfully and transparently, for specified and legitimate purposes, limited to what is necessary, kept no longer than necessary, maintained accurately and protected by appropriate security. Section 39 further requires controllers and processors to implement technical and organisational measures appropriate to the data and the risks involved.

Practical safeguards may include access controls, staff confidentiality obligations, encryption where appropriate, secure backups, data minimisation, retention schedules, staff training, risk assessments and periodic testing of security measures. The appropriate controls will depend on the nature and volume of the data, the sensitivity of the information and the potential harm that could result from misuse or loss.

6. Manage suppliers and international transfers

Where a business engages an external service provider to process personal data, the parties should document the arrangement and allocate responsibilities for confidentiality, security, permitted processing, assistance with data-subject requests and incident reporting. Section 29 addresses the obligations applicable where a controller or processor engages another processor.

Businesses should also identify whether personal data is transferred or made accessible outside Nigeria. Sections 41 to 43 regulate cross-border transfers and require an applicable basis, such as an adequate level of protection or one of the alternative conditions recognised by the Act. The organisation should document the basis relied upon rather than assume that the use of a foreign cloud provider automatically makes the transfer compliant.

7. Prepare for personal data breaches

A data breach may arise from a cyberattack, a lost device, accidental disclosure, misdirected email, unauthorised staff access or another incident affecting personal data. Section 40 requires a controller to notify the Commission within 72 hours of becoming aware of a breach that is likely to result in a risk to the rights and freedoms of individuals. Where the breach is likely to result in a high risk to a data subject, the controller must communicate the breach to the affected data subject without delay, in clear language, subject to the statutory provisions.

Organisations should maintain an incident-response procedure that allows them to contain an incident, preserve evidence, assess the data and people affected, determine notification obligations, communicate appropriately and record remedial action.

8. Check whether registration and a Data Protection Officer are required

The NDPA does not make every organisation subject to the same registration and governance obligations. Section 32 requires a data controller of major importance to designate a Data Protection Officer with the necessary expertise. Section 44 requires data controllers and data processors of major importance to register with the Commission. Whether an organisation falls within the relevant category should be assessed against the Act and the NDPC’s current regulations, directives and guidance.

A practical compliance starting point

• Prepare an inventory of the personal data the organisation holds and where it is stored.
• Document the purposes and lawful bases for each material processing activity.
• Review privacy notices, consent journeys and marketing preferences.
• Set up a process for handling data-subject requests.
• Review supplier contracts, access permissions and cross-border data flows.
• Adopt retention, security, backup and incident-response procedures.
• Assess whether the organisation is a data controller or processor of major importance and whether a Data Protection Officer or registration is required.

Conclusion

Data protection should be treated as an ongoing governance responsibility rather than a document prepared only for a website footer. Organisations that understand what information they hold, why they use it, who can access it and how it is protected are better positioned to meet their obligations and maintain the confidence of customers, employees and business partners.

The Nigeria Data Protection Act 2023 provides the statutory foundation, while the applicable NDPC regulations, directives and guidance should be considered when assessing a particular organisation’s compliance position.

Legislative reference: Nigeria Data Protection Act 2023, particularly sections 1–2, 24–29, 32, 34–40 and 41–44. The official Act is available from the Nigeria Data Protection Commission.

The content of this article is intended solely for general guidance and does not amount to legal advice. Readers are advised to seek professional legal counsel tailored to their specific circumstances.