NDPA 2023, translated for product teams.
Skip the legalese. Practical chapters, real examples, and the citations your DPO will recognise.
Seven chapters every Nigerian privacy program needs.
Who the NDPA 2023 applies to, what counts as personal data, and the controller/processor split — in plain English.
The seven principles every Nigerian data controller must satisfy, with worked examples from fintech and health.
When you can rely on consent vs legitimate interest, contract, vital interest, public interest, or legal obligation.
Access, rectification, erasure, portability, objection — and the 30-day clock you must answer them on.
When the 72-hour clock starts, what to file with the NDPC, and what to tell affected subjects.
Adequacy decisions, SCCs, and the supplementary measures you need for non-adequate jurisdictions.
When a DPIA is mandatory, when prior consultation is needed, and how to evidence the rest of §44.
How teams ship from this PDF.
- 01Share with engineering — they need it more than you think.
- 02Map your processing activities against chapters 03 and 07 first.
- 03Run the chapter 04 checklist against your DSR portal today.
- 04Schedule a quarterly re-read; the NDPC’s guidance evolves quickly.
Read the practical NDPA chapters.
Scope and definitions under the NDPA
Understand who the NDPA applies to, what counts as personal data, and how controllers, processors, and DPCMIs fit together.
Open chapterNDPA processing principles
Translate fairness, transparency, purpose limitation, minimisation, accuracy, storage limitation, security, and accountability into working controls.
Open chapterLawful bases under the NDPA
Choose and document the legal basis for each processing purpose before consent, policy, retention, and DSR workflows drift apart.
Open chapterConsent and privacy notices
Build clear consent, cookie, and notice workflows with versioning, withdrawal, and proof for each data subject.
Open chapterData subject rights and DSR operations
Run access, erasure, rectification, objection, portability, and consent withdrawal requests with identity checks and evidence.
Open chapterDPIAs and high-risk processing
Know when to run a DPIA, what to assess, who must review it, and how to keep mitigations connected to owners.
Open chapterBreach notification and incident evidence
Prepare a 72-hour breach workflow with severity scoring, NDPC-ready reports, affected-subject communication, and post-incident review.
Open chapterCross-border transfers and processors
Track processors, sub-processors, countries, transfer mechanisms, SCCs, adequacy decisions, and supplementary measures.
Open chapterAudit evidence and compliance returns
Prepare regulator, DPCO, board, and buyer evidence without rebuilding the program from folders and spreadsheets.
Open chapterTrust Centers and buyer assurance
Turn NDPA readiness, global framework status, controls, incidents, documents, and sub-processors into buyer-facing trust.
Open chapter