Compliance Centre

Data protection

The duties that attach the moment your business decides why and how personal information is processed.

EducationalCompliance topicLast reviewed 2026-08-14No named reviewer yet

What it covers

The scope of this area, in general terms.

The framework established by the Nigeria Data Protection Act 2023 and the role of the Nigeria Data Protection Commission.
Lawful bases for processing, and the principles of minimisation, purpose limitation and storage limitation.
The rights of data subjects, and being able to answer them.
Security of processing, breach handling, and the use of processors and cross-border transfers.

When it becomes relevant

Circumstances in which this area usually matters. This is not a test of whether an obligation applies to you — that depends on your specific situation and should be confirmed with the relevant authority.

You hold customer, employee, supplier or applicant information.
You run a website, an app, a loyalty scheme, CCTV, or a marketing list.
You use third-party tools that store or analyse personal data.
You transfer data outside Nigeria as part of ordinary operations.

Good practice

Practices businesses commonly put in place. Educational, not prescriptive.

Maintain an inventory of what you hold, why, where it sits and how long you keep it.
Choose a lawful basis per purpose, and prefer a durable one over consent where appropriate.
Publish a privacy notice that describes what your business actually does.
Give individual accounts with least-privilege access, and remove them on exit.
Write a breach procedure before you need one, and record every incident.

Common gaps

How this area usually goes wrong — rarely through bad faith, and almost always through nobody owning it.

A template privacy policy describing a different business.
Nobody able to say which tools hold customer data.
Shared logins to the systems holding personal records.
No retention period, so nothing is ever deleted.
No route to find everything held about one person.

When to involve a lawyer

When to speak to a lawyer

You process sensitive categories, or personal data at significant scale.
You are building profiling or automated decision-making.
A breach has occurred, or the Commission or a data subject has contacted you.
You are acquiring or transferring a database.

Find a lawyer Describe your problem

What it covers

When it becomes relevant

Good practice

Common gaps

When to involve a lawyer

Related across the platform

What it covers

When it becomes relevant

Good practice

Common gaps

When to involve a lawyer

Related across the platform