The Nigeria Data Protection Act 2023 (NDPA) governs how businesses within its scope collect, store, use, share and delete personal data. It is Nigeria’s primary data protection legislation, enforced by the Nigeria Data Protection Commission (NDPC).
Customer records, employee files and vendor contacts are all part of this work. This guide explains the law through everyday business activities and sets out what to review, document and do first.
What is the Nigeria Data Protection Act 2023?
The Nigeria Data Protection Act 2023 provides the statutory framework for protecting personal data in Nigeria. It establishes the NDPC and sets out processing principles, individual rights, business responsibilities and enforcement powers.
For your business, the practical question is what happens to information about people. Taking an order, paying an employee, answering a complaint and storing a job application all involve decisions about personal data.
Those decisions need a lawful purpose, an appropriate basis for processing and suitable safeguards. A privacy policy is one part of that work. Your actual handling of records must support what the policy says.
How do the NDPA, NDPC and GAID relate?
The NDPA is the law, the NDPC is the regulator, and the final GAID 2025 provides implementation direction.
GAID stands for General Application and Implementation Directive. It adds operational detail about matters including compliance measures, registration, audits and rights handling.
Implementation guide: Distinguish the final directive from earlier drafts. When you rely on a specific requirement, record the provision and the version you checked. An article or template referring to a draft cannot establish the current requirement.
How does the NDPA differ from the NDPR?
The NDPA is primary legislation. The Nigeria Data Protection Regulation 2019 (NDPR) was a subsidiary regulation issued by NITDA.
Businesses should review existing privacy documents against the Act and current implementation guidance. A document mentioning the NDPR does not automatically become unusable, but its legal references and operational content may need updating.
Implementation guide: an existing notice might still describe your collection purposes accurately while citing outdated guidance. Another might omit a new vendor or system. These are different problems and need separate corrections.
Who does the NDPA apply to?
The Act covers controllers and processors domiciled, resident or operating in Nigeria, processing occurring in Nigeria, and certain processing outside Nigeria involving individuals in Nigeria. Its exemptions must be assessed separately.
Implementation guide: Your business does not need to sell data to process it. Keeping payroll files, recording delivery addresses and using customer support software are processing activities. Business size alone does not establish an exemption. Identify the processing you carry out before deciding which obligations apply.
Small businesses and registration are separate questions
A small business can have data protection obligations even when it does not fall within a particular registration category.
Registration concerns additional regulatory requirements. It does not determine whether your business should address lawful basis, security, transparency or individual rights.
Implementation guide: For an owner-led retailer, start with the order records, staff information and marketing contacts already held. Assess registration separately using current NDPC guidance rather than an assumed employee-count exemption.
Personal and household use is different from business use
The Act provides an exemption for processing solely for personal, recreational or household purposes, subject to its conditions.
A business contact list does not automatically qualify because it sits on a personal phone. The purpose of the processing matters.
Implementation guide: Separate business records from private contacts. Identify who can access them and what happens when a staff member leaves. The device does not determine the processing purpose. An order discussed through a messaging app remains business processing when your organisation uses the information to provide a service.
What is a data controller?
A controller determines the purposes and means of processing personal data. Your business acts as a controller when it decides why to collect customer information and how to use it.
Keeping delivery addresses to fulfil orders is one purpose. Reusing them for another activity requires a separate assessment.
Implementation guide: Document the purpose and responsible person. A software provider storing the record does not take over your decisions about why that record exists.
What is a data processor?
A processor handles personal data on behalf of a controller. An outsourced payroll provider, for example, can act as a processor for activities your business instructs it to perform.
Outsourcing requires attention to the provider, the instructions you give and the contractual arrangements governing the work.
Implementation guide: Record which supplier handles which information. Check access, security, deletion and subcontracting arrangements rather than treating a paid subscription as sufficient evidence.
What personal data does your business handle?
Personal data is information relating to an identified or identifiable individual. It can include names, identification numbers, online identifiers and combinations of information that identify someone.
Removing a name does not necessarily make a record anonymous. Another identifier or linked system may still connect it to a person.
Implementation guide: Inventory records by activity and system so you can see where copies exist and which decisions govern them.
Customer records in everyday systems
Names, email addresses, phone numbers, delivery addresses and purchase histories can be personal data.
They often appear across order systems, spreadsheets, email and support software. Deleting a customer account in one system does not establish that every associated copy has been removed.
Implementation guide: Record where the information originates, who receives it and why each copy is needed. That inventory supports retention decisions and responses to access requests.
Employee and applicant information
Recruitment, payroll and staff administration also involve personal data. Records may include salary details, bank accounts, next-of-kin contacts, performance information and unsuccessful job applications.
These activities need their own purposes and retention decisions. A record needed for a current employee may require different handling after they leave.
Implementation guide: Include human resources records in your processing inventory. Privacy work limited to website visitors misses information your business already holds about its workforce.
What counts as sensitive personal data?
Sensitive personal data receives additional protection. The statutory categories include health information, specified biometric and genetic data, religious beliefs and political opinions.
An employee’s health information requires a different assessment from a routine work email address. Explicit consent is one permitted condition for sensitive processing; it does not replace checking which legal conditions apply.
Document the purpose, applicable condition and safeguards before relying on a general consent form.
Spreadsheets, messaging and shared drives
Personal data can sit outside your main business software. Shared drives, scanned documents, messaging groups and downloaded spreadsheets belong in your inventory when they contain business records about people.
Implementation guide: Check access permissions and duplication. A restricted payroll application offers limited protection if an exported salary file remains available to an unrestricted shared folder. Name the owner of each location and define the business purpose. Unowned copies make retention, correction and deletion harder to carry through.
What responsibilities does the NDPA place on businesses?
The NDPA establishes principles including lawful, fair and transparent processing, purpose limitation, data minimisation, retention limits, accuracy, security and accountability.
These principles apply to how your business handles information every day.
Implementation guide: Map each activity to its purpose, lawful basis, responsible person and supporting records. Your NDPA compliance records should reflect what the business does rather than a generic template.
Choose a lawful basis for each activity
The Act provides several lawful bases, including consent and processing necessary for specified contractual, legal, vital-interest, public-interest or legitimate-interest grounds.
Order fulfilment and marketing do not automatically share the same basis because they use the same email address. Assess each activity separately.
Implementation guide: Do not request consent as a substitute for assessing the actual activity. Where you rely on consent, retain evidence of what the person agreed to and how withdrawal is handled.
Explain processing through a privacy notice
Your notice should explain how you handle personal data, including the purposes, relevant recipients and rights available to individuals.
It must reflect your actual systems and practices. Introducing a new use of information requires an assessment of whether the existing notice remains accurate.
Implementation guide: Keep a dated version and a record of where it is presented. A notice hidden away from the collection process does not provide the same operational evidence as one made available where information is collected.
Collect only what the purpose requires
Personal data should be adequate, relevant and limited to what is necessary.
Each field on a form needs a purpose-based justification. Information appropriate for regulated onboarding is not automatically appropriate for a routine purchase.
Implementation guide: Record your decisions when designing forms and workflows. Removing an unnecessary field reduces the information you need to secure, maintain and eventually delete.
Set retention rules and apply them
Keep personal data only for as long as necessary for the applicable purpose and lawful basis, taking account of relevant legal requirements.
A useful retention rule identifies when the period starts, how long it lasts and what happens at expiry. The rule also needs to reach the copies your business actually holds.
Implementation guide: Distinguish legal obligations from business preferences. Verify sector-specific retention rules before setting a period for records such as financial or employment information.
Protect access and prepare for incidents
Review who can access personal data, how accounts are protected, how access is removed and how incidents are identified.
Your team should know how to raise an incident and who assesses the response. Detailed notification decisions require prompt review of the applicable legal conditions.
Implementation guide: Maintain an incident process that distinguishes a security event from a personal data breach and records the assessment. Section 40 contains notification duties with risk-based conditions. Where a controller becomes aware of a qualifying breach likely to risk individuals’ rights and freedoms, the NDPC notification requirement is within 72 hours. Assess the applicable threshold promptly; do not wait for a completed investigation to start recording decisions.
Keep evidence of the decisions you make
Accountability means being able to demonstrate the measures your business takes.
Useful evidence includes processing records, approved notices, access reviews, supplier agreements and documented request responses. It should show what was assessed, what action followed and what remains outstanding.
Asiri helps you organise privacy records and supporting evidence so your team and advisers can review the work.
What rights do individuals have under the NDPA?
The Act provides rights relating to personal data, including access, correction, erasure, withdrawal of consent, objection, portability and protections concerning automated decisions.
Conditions and exceptions matter. Your business needs a clear route for receiving requests and assessing what action is required.
Access and correction of personal data
An employee may ask to correct bank details, while a customer may request access to information your business holds about them.
Locate the relevant records and verify the request proportionately before disclosing or changing information.
Implementation guide: Record the correction and where it was carried through. Updating one spreadsheet while leaving the operational system unchanged does not resolve the underlying inaccuracy.
Withdrawal of consent and objection
Withdrawal of consent and objection are distinct requests. The appropriate response depends on the processing activity and its lawful basis.
A marketing opt-out, for example, needs to reach the system sending the messages.
Implementation guide: Record the request, assessment and resulting action. Withdrawal does not retrospectively invalidate processing lawfully carried out before withdrawal, and other processing requires its own basis.
Erasure, portability and automated decisions
These rights have conditions. An erasure request does not always require deletion of every record, and portability does not apply identically to every processing activity.
For example, an applicable legal retention obligation can affect an erasure assessment. Explain the reason for keeping information instead of issuing an unexplained refusal.
Assess the request against the actual processing and applicable requirements before promising an outcome.
What should your business do first to prepare for NDPA compliance?
Build your processing inventory
List activities such as recruitment, payroll, order fulfilment, support and marketing.
For each activity, identify the purpose, information involved, people affected, systems, recipients and lawful basis. Include retention decisions and transfers outside Nigeria.
Your processing register should make these activities understandable and reviewable.
Start with one known activity and follow its information through the business. That gives you a practical model for documenting the rest.
Review suppliers and cross-border transfers
Identify providers handling personal data for your business and where the processing occurs.
Review the relevant agreements and transfer arrangements. A supplier’s general security statement does not establish which protections apply to your particular service.
Separate confirmed information from unanswered questions, then assign someone to obtain what is missing.
Assign owners and track remediation
Give each identified gap a clear action, responsible person and target date.
A missing supplier agreement, an unreviewed notice and an unused retention rule are separate tasks. Each needs its own evidence of completion.
Revisit ownership when staff change roles or leave.
Check registration and professional support
Assess whether your organisation qualifies as a controller or processor of major importance and which registration, filing and DPO requirements apply.
A Data Protection Officer (DPO) is a role. A Data Protection Compliance Organisation (DPCO) is a professional organisation licensed by the NDPC. They serve different functions.
The Asiri marketplace can help you find advisers. Verify current credentials using official NDPC resources and agree the engagement scope in writing.
Set up a repeatable review process
Review your privacy records when systems, purposes, staff or suppliers change.
Schedule routine checks, but also identify changes requiring assessment before implementation. A new marketing tool or outsourced service may need attention before the next scheduled review.
Include requests, incidents and outstanding actions so the review reflects the work happening across the business.
Organise your privacy records with Asiri
Asiri brings privacy records, responsibilities and supporting evidence into one workspace.
Use it to document your processing activities, identify gaps and coordinate the work with your team, DPO or licensed DPCO. Your organisation remains responsible for its decisions, and professional assessments remain with the appropriate advisers.
Start with Asiri’s free plan and build a clearer record of what your business does with personal data.
FAQs about the NDPA for Nigerian businesses
What is the NDPA in Nigeria?
The NDPA is the Nigeria Data Protection Act 2023. It governs personal data processing within its scope, establishes the NDPC and sets out processing principles, individual rights and enforcement powers.
Does the NDPA apply to small businesses?
Business size does not create an automatic exemption. Assess your processing against the Act’s scope and exemptions, then check registration requirements separately.
Do I need consent for every processing activity?
No. The Act provides several lawful bases. Assess the appropriate basis for each activity. Where you rely on consent, keep evidence and provide an effective withdrawal process.
Is a privacy policy enough for NDPA compliance?
No. A privacy notice explains your processing, but your business also needs appropriate practices, safeguards and supporting records. The notice must reflect what actually happens.
What is the difference between a DPO and DPCO?
A DPO is a Data Protection Officer. A DPCO is a Data Protection Compliance Organisation licensed by the NDPC. Their responsibilities differ, and your business may need different forms of support.
What should I do when someone requests their data?
Log the request, verify identity proportionately, locate the relevant records and assess the applicable right. Respond within the applicable requirements and retain a record of the decision and action taken.
About the author
Ebunoluwa Olawole
Ready to put the ideas into practice? Try the readiness check.