NDPA 2023: a practical compliance roadmap for Nigerian organisations
The Nigeria Data Protection Act turns privacy into a board-level obligation. A structured programme produces the evidence regulators expect.
Know your obligations
The Nigeria Data Protection Act 2023 established the Nigeria Data Protection Commission (NDPC) and applies to controllers and processors that handle the personal data of people in Nigeria. Organisations designated as data controllers or processors of major importance must register with the Commission, and the NDPC's General Application and Implementation Directive adds detail on how the Act is applied in practice.
Map your data first
Compliance starts with a record of processing: what personal data you hold, why, on which lawful basis, where it is stored, who can access it and where it is transferred. Without this map, policies and tools cannot be scoped correctly.
Assess high-risk processing
Processing that is likely to result in a high risk to individuals, such as large-scale health, financial or children's data, or automated decision-making, requires a data protection impact assessment before it begins. AI use cases should be included in this assessment.
Prepare for incidents
The Act requires personal-data breaches that are likely to risk individuals' rights to be notified to the NDPC within 72 hours, and in some cases to the individuals affected. A tested incident process, with clear decision points and evidence capture, is the most reliable way to meet that deadline.
Accountability at board level
Designate a data protection officer, train staff and report privacy risk to leadership. Penalties for controllers and processors of major importance can reach the higher of NGN 10 million or 2% of annual gross revenue, so privacy should sit alongside information security in board reporting. A single control framework, for example based on ISO/IEC 27001 or NIST CSF 2.0, serves both.
Related insights
Choosing an ERP for a public agency: IPSAS, controls and procurement
Public-sector ERP succeeds or fails on budget control, auditability and procurement discipline, long before features are compared.
Read
From pilot to production: an evaluation-first approach to enterprise AI
Most AI pilots stall because nobody defined what good looks like. Evaluation should come before the model, not after the demo.
Read