Personal information is part of everyday operations, from customer enquiries and staff records to online orders. The Nigeria Data Protection Act 2023 sets a legal framework for processing personal data in Nigeria.
This overview is general information, not legal advice. The right approach depends on the organisation, the data involved, the purpose of processing and the current applicable rules.
Start with the data and its purpose
Make an inventory of the personal data your organisation collects, where it comes from, who can access it, where it is stored, and when it is shared or deleted. For each use, identify and document the purpose and the applicable lawful basis. Collecting less data, and keeping it only as long as needed, can reduce unnecessary exposure.
Build privacy into ordinary processes
Review the information given to people when their data is collected, access controls, retention practices and procedures for responding to data incidents and requests. If an external service provider handles personal data for the organisation, clarify responsibilities and safeguards in the relevant arrangements.
Check accountability and applicable duties
The Act provides rights for data subjects and duties for organisations that determine or carry out processing. Which requirements apply can depend on the facts and the current rules and guidance issued by the Nigeria Data Protection Commission (NDPC). Organisations should assess their position rather than assume that one checklist fits every business.
- Map processing activities and explain their purposes.
- Review notices, internal access, retention and security practices.
- Set a process for handling data subject requests and potential breaches.
When to seek tailored advice
Consider a focused review when launching a new product, introducing a new use of personal data, sharing data with a provider, responding to a suspected breach or receiving a formal request. A review can help identify which requirements apply and what practical steps are proportionate to the processing.
Vellum Law Practice advises on data protection and privacy matters. Contact us to discuss your organisation's circumstances.
This article is general information, not legal advice. Contact us for advice on your situation.