NDPA compliance checklist for Nigerian businesses

The Nigeria Data Protection Act 2023 (the NDPA) is the main law on personal data in Nigeria. It created the Nigeria Data Protection Commission (NDPC), which enforces it. In 2025 the NDPC issued the General Application and Implementation Directive (GAID), which explains how the Act works in practice. It took effect on 19 September 2025.

This checklist is a practical starting point, not legal advice. For a large or unusual case, speak to a data protection lawyer.

1. Know what personal data you hold

You can’t protect what you haven’t listed. Write down:

• What personal data you collect: names, phone numbers, emails, ID numbers, bank details, health information.
• Where it lives: your app, spreadsheets, email, a CRM, paper files, cloud services.
• Why you collect it, and who you share it with.
• How long you keep it.

This list becomes the base for everything else.

2. Have a lawful reason for each use

The Act lists the lawful reasons for using personal data. Common ones are the person’s consent, a contract with them, a legal duty, and your legitimate interest (as long as it doesn’t override their rights). Match each use on your list to one reason. If the reason is consent, make it a clear yes that people can withdraw later.

3. Tell people, in plain language

Publish a privacy notice that says what you collect, why, who you share it with, how long you keep it, and how people can use their rights. Put it where people give you their data, such as next to every form.

4. Respect people’s rights

People can ask you to show them their data, correct it, delete it, stop or limit how you use it, or move it elsewhere. Set up a simple way to receive these requests and answer them on time. Know who in your team handles them.

5. Check whether you must register with the NDPC

The GAID sets out which organisations are data controllers or processors of major importance. These must register with the NDPC. It groups them into three levels: Ultra-High, Extra-High and Ordinary-High. The level depends on things like how many people’s data you handle and how important it is.

• Ultra-High and Extra-High organisations file a compliance audit return every year by 31 March.
• Ordinary-High organisations renew their registration every year.
• Changes to your registration details must be reported to the NDPC within 60 days.

If you’re not sure which group you fall into, check the GAID itself (linked below) or ask the NDPC.

6. Audit, train and appoint

• Audit: carry out an NDPA compliance audit within 15 months of starting business, and then every year.
• Train: train staff on data protection within six months of starting business, and then at least once a year.
• Appoint: organisations of major importance must appoint a Data Protection Officer to oversee compliance.

7. Secure the data

The Act expects security that fits the risk. At a minimum:

• Strong passwords and two-factor login on every system that holds personal data.
• Access only for the staff who need it.
• Encryption for data in transit (HTTPS) and, where possible, at rest.
• Regular security testing, such as a penetration test, to find weak spots before attackers do.
• Backups you have actually tested.

8. Be ready for a breach

Under Section 40, if a breach is likely to put people’s rights at risk, you must tell the NDPC within 72 hours of finding out. If the risk is high, you must also tell the people affected, in plain language, with steps they can take to protect themselves.

Write a short breach plan now: who decides, who calls the NDPC, who talks to customers, and where your logs are. A plan written in calm times saves days in a crisis.

9. Check your suppliers

If a cloud provider, payroll service or marketing tool handles personal data for you, you are still responsible. Use written contracts that require them to protect the data, and check where they store it. The Act has rules for sending personal data outside Nigeria.

10. Do a DPIA for risky projects

Before launching something that could seriously affect people’s privacy, such as large-scale tracking, sensitive data or new technology, carry out a Data Protection Impact Assessment (DPIA). It’s a written look at the risks and how you’ll reduce them.

Where to start this week

1. Make the data list from step 1.
2. Put a privacy notice next to every form.
3. Turn on two-factor login everywhere.
4. Write a one-page breach plan.

These four steps cover most of the risk for most businesses. We help Nigerian businesses with the security side of NDPA compliance: finding weak spots, monitoring, staff training and preparing evidence for audits.