NDPA Compliance Checklist for Nigerian SMEs: Where to Start

An NDPA compliance checklist starts with knowing what personal data your business holds, why you use it, where it goes and who is responsible for it. From there, you can review your practices, address gaps and build a routine for keeping the work current.

For a small business, that information is usually already close at hand. It is in your customer orders, employee files, supplier emails, booking forms and marketing contacts. The starting point is to understand how those records move through your business.

You might run a retail store that takes orders through WhatsApp, a consultancy with client contacts in a shared spreadsheet, or a growing company using an external payroll provider. Each has different needs, but the first practical questions are similar. What do we collect? Who can see it? Why do we keep it? What happens when someone asks us to change or remove it?

Use this checklist to turn those questions into work your team can manage. It is a starting plan, rather than proof that every requirement has been met.

1. What personal data does your business hold?

Begin by choosing one activity you understand well. Order fulfilment is often a useful place to start. Follow an order from the first enquiry to payment, delivery and any complaint afterwards. Write down the information collected at each stage, the tools used and the people who receive it.

A customer’s name and phone number might begin in a message, move into a sales spreadsheet and then reach a dispatch rider. A delivery address could remain on an employee’s phone after the order is complete. Following that journey gives you a more useful picture than simply writing “we collect customer data.”

Repeat the exercise for recruitment, payroll, customer support and marketing. Include paper files and downloaded copies. If your team uses a personal device for business records, include that too. The information does not stop being part of your business activity because it sits outside the main software.

Implementation guide: Ask each person handling customer or staff information to show you the tools they actually use. A short walkthrough often reveals spreadsheets, messaging groups and exports that never appear on an official systems list.

2. Why do you collect it, and what basis applies?

Next, connect each activity to a clear purpose. “We might need it later” is not a useful explanation for collecting information. Your team should be able to say what the information helps the business do and whether every field is necessary.

For example, you may need a delivery address to send a purchased item. That does not explain why the same checkout form asks for a customer’s date of birth. If your business cannot identify a reason for that field, review whether it should be there.

Look at forms, questionnaires and onboarding documents with this in mind. Some information may be necessary because of the service you provide or an applicable requirement. Other fields may have been copied from an old template without anyone questioning them. Remove unnecessary collection where appropriate, and document the reason for the fields you retain.

You also need an appropriate lawful basis for each activity. Consent is one option, but it is not the automatic answer to every processing question. Assess the activity and the basis that applies before deciding what to tell the person.

Fulfilling an order and sending promotional messages are different uses of a customer’s details. Do not assume that providing a phone number for delivery means the customer has agreed to future marketing. Where you rely on consent, make the choice clear, retain evidence of it and provide a workable way to withdraw it.

Implementation guide: Pick one customer form and one staff form. For each field, ask what it is for, whether it is needed and how you explain its use. Take unresolved lawful-basis questions to a qualified privacy adviser.

3. Does your privacy notice match what you do?

Once you understand the activity, review what your privacy notice says about it. Does the notice describe your current practices? Can a customer or employee find the information when they need it? Is the wording understandable to someone unfamiliar with your systems?

A copied notice can create problems if it mentions services your business does not use or leaves out providers that receive information. Compare the notice with your actual records. Check the contact route, purposes, recipients, retention explanation and information about people’s rights.

Keep customer-facing information separate from staff guidance where that makes the documents clearer. Customers need to understand what happens to their information. Employees also need practical instructions about sharing files, handling requests and raising concerns.

Implementation guide: You do not need to rewrite every document in one sitting. Start with the notice covering your busiest collection point, such as a booking form or online checkout. Correct the obvious mismatches, then arrange a proper review of the remaining content.

4. Which suppliers receive your data?

Your next check is the people and businesses receiving personal data on your behalf. These could include payroll providers, cloud-storage services, email-marketing platforms, customer-support tools and outsourced administrators. Identify the service, the information involved and what the provider does with it.

Paying for a subscription does not answer the data-handling questions. Find the relevant agreement and ask how access is controlled, whether other providers are involved and what happens to your information when the service ends. Check where processing takes place, including overseas hosting or support access.

If the answers are unclear, record the question and contact the provider. A general statement that a service is “secure” may be useful context, but it does not explain the arrangements for your particular account. Obtain advice where transfer arrangements or supplier terms need specialist assessment.

Implementation guide: Begin with providers that receive the most sensitive information or support essential business activities. Reviewing your payroll service may deserve attention before a tool that holds only a few public business contacts.

5. Who can access your records?

Now look at access within your own team. Who can open the payroll folder? Who can export the customer list? Are former staff still members of a shared drive or messaging group? Does everyone use the same password for a business account?

Give people access based on the work they need to perform. Review accounts when someone joins, changes responsibilities or leaves. Use individual accounts where possible, enable multi-factor authentication on supported services and keep recovery details under the business’s control.

Also check the everyday sharing habits that can bypass your settings. A restricted folder offers limited protection if someone downloads its contents and sends them to an unrestricted group. Explain where files should be stored and how approved sharing should happen.

Implementation guide: Keep this guidance usable. A brief instruction showing the approved location for customer records can help more than a lengthy policy staff cannot follow. Ask your team to demonstrate the process so you can spot problems early.

6. How long should you keep the information?

Retention deserves its own attention. Many small businesses keep records indefinitely because nobody has decided when they can be removed. Start by separating records needed for current work from information retained for a specific legal, contractual or operational reason.

For each record type, decide what starts the retention period, how long the information is needed and what should happen afterwards. Check applicable requirements before deleting employment, financial or other records subject to specific obligations. Avoid giving every file the same period simply because that is easier to remember.

Make sure the decision reaches the places where copies exist. Closing a customer account will not remove a downloaded spreadsheet. Deleting an applicant’s email will not clear an attachment saved in a shared folder. Your process should identify the relevant locations and any exceptions requiring continued retention.

Someone also needs responsibility for carrying out the review. A retention schedule that never leads to action leaves the underlying problem in place.

7. Can your team handle a personal data request?

The next part of the checklist is handling requests from people. A customer may ask for their information, an employee may ask to correct a record, or a former subscriber may ask you to stop marketing to them. Your team should recognise these requests even when the person does not use formal privacy language.

Choose a clear contact route and make sure messages reach the person responsible. Record when the request arrived, what was asked and the systems likely to contain relevant information. Verify identity proportionately before disclosing records, and assess the applicable requirements and response timing.

Avoid promising deletion before you understand what the request covers. Some records may need to be retained, while others can be removed. Equally, an unsubscribe action should reach the system sending the messages, rather than ending as a note in someone’s inbox.

Implementation guide: Run a simple practice request. Ask your team how they would locate a customer’s order history and correct an inaccurate phone number across the relevant systems. The exercise will show whether your inventory works in practice.

8. What happens when something goes wrong?

Prepare for incidents before one happens. A lost phone, an incorrectly shared attachment or an account accessed by an unauthorised person needs a clear response route. Staff should know whom to contact immediately and what information to preserve.

Your first actions should address the immediate problem and establish the facts. Restrict inappropriate access where possible, record what happened and seek the right help. Avoid deleting messages or logs that may be needed to understand the incident.

Notification decisions can be time-sensitive. A qualifying breach may require notification to the NDPC within 72 hours of awareness; communication to affected people involves a separate assessment. Arrange prompt professional review rather than waiting for every detail to become available.

Keep contact details for the people supporting your response somewhere staff can reach them. An incident plan stored only in an account you can no longer access will be difficult to use.

9. Do you need registration or professional support?

You should also assess registration and professional support. Being an SME does not automatically settle which obligations apply. Your activities, the people whose information you process and other relevant factors need to be considered using current NDPC guidance.

Check whether registration, a DPO appointment or audit-related obligations apply to your organisation. These are different questions. Avoid buying a generic package before understanding what your business needs and what the provider will deliver.

A DPO and a licensed DPCO also serve different functions. When you seek help, explain your activities, share the gaps you have identified and ask for a written scope. Establish the deliverables, exclusions, fees and information the professional needs from your team.

10. Who owns the next action?

By this point, you may have a long list of improvements. Turn it into a manageable plan. Give each action an owner, a target date and a clear description of what completion looks like.

“Improve privacy” is too broad to assign. “Remove former employees’ access to the shared customer folder” is specific. “Review supplier contracts” may need to become several tasks, beginning with locating the agreements and identifying unanswered questions.

Prioritise issues involving exposed information, sensitive records, active requests or urgent deadlines. Then work through the wider improvements. Keep unresolved questions visible so they do not disappear beneath completed tasks.

Set a review rhythm that suits your business, and include checks when something changes. A new payroll provider, marketing platform or delivery arrangement can affect the records you documented earlier. Review those changes before the old process becomes inaccurate.

Start your privacy workspace with Asiri

There is no need to wait for a polished policy pack to organise this work. Bring together the systems list, existing notices, supplier agreements and outstanding questions you already have. They provide a practical starting point for your team and advisers.

Asiri for small businesses helps you organise privacy records, see what needs attention and work with your DPO or DPCO. Use the workspace to turn identified gaps into actions and keep supporting evidence alongside the work.

Asiri supports audit readiness. It does not conduct or file audits, replace a licensed DPCO or establish compliance on its own. Your business remains responsible for its practices and decisions.

The useful result of this checklist is a clearer understanding of your information and a plan your team can carry out. Start with one activity, complete the next action and keep the record current as your business grows.

Start your privacy workspace on Asiri for free and track what needs attention.