If your business collects customer or staff data, the Nigeria Data Protection Act 2023 applies to you. Start with these steps.
The Nigeria Data Protection Act 2023 (NDPA) sets out how organisations must collect, use, store and share personal data, and established the Nigeria Data Protection Commission to oversee compliance.
Know your data
Map what personal data you hold, why you hold it, where it is stored and who can access it. You cannot protect what you have not identified.
Establish a lawful basis
Every processing activity needs a lawful basis, such as consent, contract or legal obligation, and people must be told clearly how their data will be used.
Put governance in place
Appoint someone accountable for data protection, adopt clear policies, and put written agreements in place with vendors who process data for you.
Prepare for incidents
Have a breach-response plan that identifies who acts, who is notified and how the regulator and affected individuals are informed within the required timelines.
This article is general information and not legal advice.
This article is general information, not legal advice. Laws change and every situation is different — speak to a lawyer about yours.