Educational · Data Protection
You collect phone numbers to confirm orders. Does the NDP Act 2023 apply to you? What it asks of an organisation, without the compliance jargon.
Published · 9 min read
The Nigeria Data Protection Act 2023 is not written only for banks and telecoms. It applies to the processing of personal data, and personal data is any information relating to an identifiable individual — a customer's phone number, a delivery address, a photograph, a WhatsApp order history.
If your business collects that kind of information about customers, staff or suppliers, the Act is speaking to you. Some obligations scale with the size and risk of what you do, but the basic duties do not switch off because a business is small.
The Act distinguishes the party who decides why and how personal data is processed — the data controller — from the party who processes it on that party's behalf, the data processor.
A shop that collects customer numbers is a controller. The delivery service or software provider it passes those numbers to is usually a processor. It matters because the duties, and the paperwork between the two, differ.
Personal data must be processed lawfully, fairly and transparently; collected for specified, legitimate purposes and not used in ways incompatible with them; adequate and limited to what is necessary; accurate and kept up to date; kept no longer than necessary; and kept secure.
In a small business those principles cash out as small habits. Collect the phone number because you need to confirm the order, not because the form has a space for it. Say what you will use it for. Do not sell the list. Delete what you no longer need.
Every processing activity needs a lawful basis. Consent is one — and where you rely on it, it must be freely given, specific and capable of being withdrawn as easily as it was given. Performance of a contract, a legal obligation, a vital interest, a public interest task and legitimate interests are the others.
Marketing is where small businesses most often go wrong: adding a customer to a broadcast list because they once bought something is not automatically covered by the consent they gave for the order.
Data subjects have rights: to be informed, to access their data, to have it corrected, to have it deleted in defined circumstances, to restrict or object to processing, and to portability.
A business needs a route by which a person can make such a request and a habit of answering it within the time the Act allows.
You must take appropriate technical and organisational measures to protect personal data. For most small organisations that means access control, staff who understand the rules, and not keeping customer records in a personal chat archive indefinitely.
Where a personal data breach occurs, the Act imposes notification duties — to the Nigeria Data Protection Commission and, where the risk to individuals is high, to the individuals themselves. Decide now who would make that call, because the clock runs from discovery.
Keep reading
Twelve fundamental rights sit in Chapter IV of the 1999 Constitution. We take each one in turn, in plain language, with the everyday situations where it matters most.
Nine clauses decide most workplace disputes. Here is what each one does, and the questions to ask before anyone signs.
Governors hold land in trust. That single principle explains consent requirements, certificates of occupancy and much of what buyers find confusing.
