Law for CEOs

What a data regulation actually means for your company

A policy is a description. What a regulator, a customer or a court engages with is whether the description is true - and whether you can show it.

EducationalExecutive briefingLast reviewed 2026-08-14No named reviewer yet

We have a privacy policy. Why is that not the answer?5 min read

Key points

The Nigeria Data Protection Act 2023 put the framework on a statutory footing, with the Nigeria Data Protection Commission as regulator.
The unit of compliance is the data inventory, not the policy. You cannot describe accurately what you have never mapped.
Consent is the weakest basis for most ordinary business processing, because it can be withdrawn. Contract and legitimate interests are usually more durable.
Your processors remain your responsibility. Outsourcing the handling does not move the duty.
Being unable to answer a data subject is itself the failure - the question rarely gets harder than 'what do you hold about me?'

Exposure rarely sits where the accountability does. This is where it tends to surface first.

Take these into the meeting. The value is usually in how long the answers take.