Every business that collects names, phone numbers, emails or payment details is handling personal data. In Nigeria, that activity is governed by the Nigeria Data Protection Act 2023 (NDPA), which established the Nigeria Data Protection Commission (NDPC) to oversee compliance. This NDPA checklist turns the main requirements into practical questions you can answer today.
This article is general guidance, not legal advice. For your specific obligations, consult a qualified data protection professional or lawyer.
Why the NDPA matters for your business
The NDPA applies to organisations that process the personal data of people in Nigeria. Beyond the risk of penalties, customers increasingly expect their data to be handled carefully. A breach or misuse of data can damage trust far faster than it was built. Good data protection is also simply good business: cleaner data, fewer security incidents and smoother partnerships with larger clients who ask about your practices.
Section 1: Know what data you hold
- Do you have a list of the personal data you collect (names, phone numbers, addresses, ID numbers, health or financial details)?
- Do you know where each type of data is stored: website forms, WhatsApp, email, spreadsheets, CRM or paper files?
- Do you know who in your organisation can access it?
- Do you know which third parties (payment providers, cloud services, marketing tools) receive it?
You cannot protect what you have not mapped. A simple data inventory is the foundation of compliance.
Section 2: Have a lawful basis
The NDPA requires a lawful basis for processing personal data. The recognised bases include consent, performance of a contract, legal obligation, vital interests, public interest and legitimate interests.
- For each type of data, can you say why you collect it and which lawful basis applies?
- Where you rely on consent, is it freely given, specific and recorded, and can people withdraw it easily?
- Do you avoid collecting data “just in case”? Collect only what you need for a clear purpose.
Section 3: Be transparent
- Does your website have a clear, up-to-date privacy policy explaining what you collect, why, how long you keep it and who you share it with?
- Do your forms explain how the information will be used at the point of collection?
- Do marketing messages include an easy way to opt out?
Section 4: Respect people’s rights
Under the NDPA, individuals have rights over their data, including the right to be informed, to access their data, to have it corrected or deleted, to restrict or object to processing, and to data portability.
- Do you have a simple process for handling these requests?
- Does someone own responsibility for responding promptly?
- Can you find all the data you hold about one person if they ask?
Section 5: Keep data secure
Security is where many small businesses are most exposed. Check that:
- Staff accounts use strong passwords and multi-factor authentication.
- Laptops and phones that hold customer data are encrypted and protected with a screen lock.
- Access is limited to people who need it, and removed promptly when staff leave.
- Software and plugins are kept up to date.
- Data is backed up and backups are tested. Our 3-2-1 backup guide explains a simple approach.
- Your website uses HTTPS and its forms do not expose data.
Section 6: Manage third parties
- Do you have agreements with service providers that process data on your behalf, setting out how they protect it?
- If data is transferred outside Nigeria (for example to cloud services), have you checked that the transfer meets the NDPA’s requirements?
Section 7: Be ready for a breach
The NDPA requires data controllers to notify the NDPC of certain personal data breaches within 72 hours of becoming aware of them, and in some cases to inform the affected individuals.
- Do you have a written incident response plan?
- Do staff know how to report a suspected breach internally?
- Do you know who would contact the Commission, and what information they would need?
Section 8: Check whether extra obligations apply
Some organisations are classed as data controllers or processors of major importance, based on factors such as the volume and sensitivity of data they handle. These organisations have additional duties, such as registering with the NDPC and designating a Data Protection Officer. The NDPC has also issued implementation guidance, the General Application and Implementation Directive (GAID), which explains how the Act applies in practice. Check the Commission’s current guidance to confirm whether these duties apply to you.
Section 9: Train your people
Most data incidents start with a human mistake: a phishing email, a shared password or a file sent to the wrong person.
- Have staff received basic data protection and security training in the last year?
- Do they know not to paste customer data into unapproved tools, including AI chatbots? See our guide to writing a simple AI policy.
Scoring yourself
Count the questions you could answer “yes” to with confidence. If you answered “no” or “not sure” to more than a handful, prioritise data mapping, security basics and your privacy policy first. These deliver the biggest reduction in risk for the effort involved.
How Geopaju can help
Our cybersecurity and compliance team helps Nigerian businesses find security gaps, put the right controls in place and work towards NDPA compliance, in plain language and at a pace that suits your business. Book a free consultation to review where you stand.
