Data protection means collecting, using, sharing and keeping personal information lawfully, with safeguards that respect the people it concerns. For a Nigerian business, that includes customer contact details, staff records, identity documents and information held by suppliers on your behalf.
The Nigeria Data Protection Act 2023 (NDPA) sets rules for handling personal data. The Nigeria Data Protection Commission (NDPC) issues implementing requirements. What your business must do depends on how it uses information, the risks involved and, for some requirements, its regulatory classification.
To establish what applies to your organisation, complete the 6030 Technologies NDPA compliance assessment. Your business details help us assess the work required and prepare a proposal.
What data protection covers
Personal data is information that identifies someone directly or indirectly. A customer’s name and phone number qualify, but so can an account identifier, location record or CCTV image that can be linked to a person. Paper files count too. These examples follow the definitions in section 65 of the NDPA.
Some information needs additional care. Health records, religious beliefs and biometric data used to identify a person fall within the Act’s sensitive personal data categories. Processing these records requires a suitable condition under section 30 as well as a lawful basis.
Cybersecurity supports data protection by controlling access and preventing loss or misuse. Data protection also governs why you collect information, what you tell people and when you delete it. A securely stored customer list can still be used for an unlawful purpose.
Nigeria’s data protection rules and NDPC registration
The NDPA applies to processing within Nigeria and to organisations operating here. It also covers organisations outside Nigeria that process the personal data of individuals in Nigeria, subject to the Act’s scope and exemptions. The NDPC explains this territorial reach in its official frequently asked questions.
Use the Act together with the General Application and Implementation Directive 2025 (GAID). Article 3 states that the Commission will cease applying the NDPR 2019 as its regulatory instrument, while preserving things previously done under it.
NDPC registration applies to designated data controllers and data processors of major importance (DCPMIs). Classification considers processing volume, sector, sensitivity and other criteria. Check the NDPC registration guidance against your actual activities; a small workforce does not, by itself, settle the question.
| Classification | Registration and annual filing under GAID |
|---|---|
| Ultra-High Level (UHL) or Extra-High Level (EHL) | Register once and file annual Compliance Audit Returns (CAR), normally through an NDPC-licensed Data Protection Compliance Organisation. |
| Ordinary-High Level (OHL) | Renew registration annually. GAID article 9(3) removes the annual CAR requirement when that renewal is completed. |
GAID articles 7, 9 and 10 distinguish registration, audits and filing. The annual CAR deadline is 31 March; article 10(8) provides an initial filing period of up to 15 months after establishment for relevant organisations established after 12 June 2023. Confirm your first filing date and any applicable NDPC directions. Registration and filing do not replace everyday compliance.
Build a practical data protection process
Map the information your business holds
Start with a register of processing activities. Identify the information collected, its purpose, where it sits, who can access it, who receives it and how long you need it. Include paper registers, email attachments, messaging apps and cloud systems.
Record your role for each activity. A data controller decides the purpose and means of processing; a data processor handles information on another organisation’s instructions. For example, a payroll provider may process client records while acting as controller for its own employees’ data.
Choose and document a lawful basis
Section 25 of the NDPA recognises consent, contract, legal obligation, vital interests, public interest or official authority, and legitimate interests. Match the basis to each purpose before processing begins.
For example, using a delivery address to fulfil an order may be necessary for a contract. Keeping a record required by law may rest on a legal obligation. Legitimate interests require an assessment of the purpose, necessity and impact on individuals; commercial convenience alone is insufficient.
Where you rely on consent, make it specific and informed, record it and allow withdrawal. Silence and pre-ticked boxes do not establish consent. Do not assume that permission to complete one transaction also permits unrelated marketing.
Explain your processing and limit collection
Give people a clear privacy notice when you collect their information. Explain your identity, purposes, lawful bases, recipients, retention periods, rights and complaints route. Include relevant information about automated decisions. Section 27 specifies the information required.
Review each form field. Collect only what the purpose needs, keep records accurate and set retention periods you can justify. A delivery enquiry rarely needs the same information as employment onboarding. Apply the minimisation and retention principles in section 24 to each activity.
Protect paper and digital records
Security measures should reflect the amount and sensitivity of the data and the harm that misuse could cause. Section 39 requires appropriate technical and organisational safeguards, including assessment of whether those safeguards work.
Practical measures to consider include:
- Give staff individual accounts and access only to the records their work requires.
- Use multi-factor authentication, supported software and timely security updates.
- Encrypt sensitive files and devices where appropriate, and test recovery from backups.
- Keep paper records in locked storage with controlled access.
- Remove access when staff leave or change roles, and securely dispose of records when retention ends.
Assign someone to check these controls regularly. Test, for example, whether a former employee’s account can still open the customer database.
Review suppliers and assess higher-risk processing
Check what your payroll provider, hosting company and other processors do with personal data. Put processing instructions, security duties, breach reporting and return or deletion arrangements into the relevant agreements. Review their safeguards before granting access. Section 29 covers engagement of processors.
Check where cloud services store or access information. Transfers outside Nigeria require a valid route under sections 41–43, with the transfer basis and adequacy assessment recorded. Include any applicable sector rules in that review.
Before processing that is likely to create high risks, carry out a data privacy impact assessment (DPIA). GAID article 28 also specifies activities requiring a DPIA, including healthcare, e-commerce, certain automated decisions and surveillance cameras in publicly accessible places. Check those triggers and submission requirements before introducing a new service.
Train staff and respond to people’s requests
Staff need to know how to recognise personal data, check recipients before sending records and report a mistake promptly. Use examples from their actual work. GAID article 7 calls for personnel training within six months of starting business and at least annually afterwards.
Give customers and employees a clear route to request access, correct information, seek deletion or raise an objection. Verify identity proportionately, log the request and assess it against the applicable right and any lawful retention duty. Under sections 34–37 of the NDPA, people have rights that include access, correction, withdrawal of consent and objections to direct marketing.
Assign responsibility for the process and assess your obligation to designate a Data Protection Officer (DPO). GAID article 7 requires DCPMIs to designate one. The DPO needs access to management, resources and sufficient independence to perform the role.
Respond promptly to a personal data breach
A lost file, misdirected email or compromised account may involve a personal data breach. Contain the incident, preserve evidence and assess what happened, whose information is involved and the likely harm.
Section 40 of the NDPA sets different responsibilities:
- A processor must notify the controller or processor that engaged it when it becomes aware of a breach.
- A controller must notify the NDPC within 72 hours of becoming aware of a breach likely to risk individuals’ rights and freedoms.
- Where a breach is likely to create a high risk, the controller must communicate with affected individuals immediately, subject to the Act’s provisions on the form of communication.
Keep a record of every personal data breach, its effects and remedial action. The Act permits information to be supplied in phases without undue delay, so an incomplete investigation should not postpone a required initial notification.
Data protection support from 6030 Technologies
6030 Technologies provides NDPA gap assessments, compliance documentation, DPO services, staff training and support with registration and CAR filing. The NDPC’s public register of licensed DPCOs lists 6030 TECHNOLOGIES LTD as active.
The scope depends on your processing activities, systems, regulatory category and existing controls. We collect the required business details, complete an assessment, then provide a detailed proposal describing the work and pricing, including professional fees and any applicable registration charges.
Frequently asked questions
Does data protection apply to small businesses?
It can. A business handling personal data must assess its obligations under the NDPA. Company size alone does not create an exemption, and registration is a separate classification question.
Do I need consent for every use of personal data?
No. Consent is one of the lawful bases in section 25. Select the basis that fits the purpose and satisfy any additional conditions, particularly for sensitive personal data.
Does an NDPC registration certificate prove full compliance?
Registration is one requirement. The organisation must still meet its applicable duties for lawful processing, security, individual rights, audits and breach response.
Does data protection cover paper records?
Yes. The Act’s definition of processing includes activities carried out without automated systems. A paper staff file or customer register needs appropriate protection.
Can a business use cloud services outside Nigeria?
It must assess the transfer against sections 41–43 of the NDPA, GAID and any applicable sector requirements. Check the provider’s locations, contractual safeguards and permitted transfer basis before proceeding.
Establish your next compliance steps
Start the NDPC/NDPA compliance assessment with details of your business, data processing and existing controls. You can also email info@6030technologies.com or call +2349037692946 to discuss the scope.