The Nigeria Data Protection Act 2023 (NDPA) came into force in June 2023, replacing the earlier NDPR framework. It applies to any organisation processing the personal data of Nigerians — whether the organisation is based in Nigeria or abroad.
1. Appoint a Data Protection Officer
Any organisation processing personal data of major importance must designate a DPO.
2. Register with the NDPC
Data controllers and processors of major importance must register with the Nigeria Data Protection Commission.
3. Conduct a data audit
Map every category of personal data you collect, why, where it is stored, who accesses it, and how long you keep it.
4. Refresh your Privacy Policy
State your lawful basis for processing, retention periods, subject rights and complaints route — in plain language.
5. Consent mechanisms
Where consent is your lawful basis, it must be freely given, specific, informed and unambiguous.
6. Data subject rights
Subjects have the right to access, correct, delete, port and object. Handle these within 30 days.
7. International transfers
Transfers outside Nigeria must be to jurisdictions with adequate protection.
8. Breach notification
Report significant breaches to the NDPC within 72 hours.