Loading content
Before You Do This · Data Protection
What counts as personal data, why you are processing it, how long you keep it, and the duties the Nigeria Data Protection Act 2023 places on the organisation holding it.
The situation: Your product or shop is about to store personal information
A business becomes a data controller the moment it decides why and how personal information is processed - not when it reaches a particular size, and not only when it runs a website.
The Nigeria Data Protection Act 2023 establishes the framework and the Nigeria Data Protection Commission as the regulator. The practical work it asks for is unglamorous: know what you hold, know why, hold less, keep it safe, and be able to answer the person it belongs to.
What the law is doing in this situation, and which instrument it sits under. These are general explanations, not an assessment of your circumstances.
Personal data is broader than people expect
It is information relating to an identifiable person - not only names and identification numbers, but phone numbers, delivery addresses, photographs, device identifiers and records that identify someone when combined. Customer lists, CCTV footage and staff files all sit inside it.
Nigeria Data Protection Act 2023
You need a reason before you need consent
Processing has to rest on a lawful basis. Consent is one basis among several, and it is often the weakest for a business, because it can be withdrawn. Performing a contract, meeting a legal obligation and legitimate interests are the bases most ordinary trading actually runs on.
Nigeria Data Protection Act 2023
Collect less, and keep it for less time
Data minimisation and storage limitation do more for a small business than any policy document. Data you never collected cannot leak, cannot be misused, and does not have to be produced when someone asks what you hold.
Data subjects have rights you must be able to service
People can ask what you hold about them, ask for corrections, and object to certain processing. A business that cannot find its own records cannot answer - and being unable to answer is itself the problem.
Nigeria Data Protection Act 2023
Your processors are still your responsibility
Payment providers, cloud hosts, marketing tools and delivery partners process data on your behalf. The relationship should be written down, and the fact that a supplier handles the data does not move the duty off the business that decided to collect it.
Cross-border transfers need thought
Most ordinary tooling stores data outside Nigeria. The Act addresses transfers out of the country, and a business should at minimum know where its data physically sits and under what arrangement.
Nigeria Data Protection Act 2023
These are ordinary and usually well-intentioned. That is exactly why they are worth naming.
None of these is proof of bad faith on its own. Two or three together is a reason to slow down.
Work through these before you commit. They are educational prompts, not a compliance certification.
When to speak to a lawyer