Most conversations about the NDPA focus on policies and paperwork. But many of its requirements can only be met with the right technology in place. This article looks at the NDPA from an IT point of view: what it expects, and what you can do about it.
This article is a practical overview, not legal advice. For questions about how the law applies to your organisation, speak to a qualified data protection professional.
If your organisation collects or uses information about identifiable people, such as customers, patients, students or your own employees, the NDPA applies to you. That covers almost every business, from banks and hospitals to schools, retailers and professional firms.
Organisations the NDPC classifies as data controllers or processors of major importance have extra obligations, including registering with the Commission and appointing a Data Protection Officer. Penalties for this group can reach the higher of ₦10 million or 2% of annual gross revenue, and the higher of ₦2 million or 2% for others.
The Act requires “appropriate technical and organisational measures” to protect personal data against loss, misuse and unauthorised access. It names safeguards such as encryption and pseudonymisation, and expects you to test that your controls actually work.
In practice, that means:
If a personal data breach is likely to put people at risk, you must notify the NDPC within 72 hours of becoming aware of it, and tell affected individuals without undue delay when the risk is high.
Seventy-two hours is not long. You can only meet it if you can detect a breach quickly and understand its scope: which systems, which data, how many people. Centralised logging, alerting on suspicious activity, and a written incident response plan make the difference between a controlled response and a scramble.
You cannot protect, report on or delete data you cannot find. Personal data tends to spread: into shared drives, email attachments, spreadsheets on laptops, old backups and cloud apps that nobody approved.
A data map records what personal data you hold, where it is stored, who can access it and how long you keep it. It underpins almost every other obligation, from answering a subject access request to scoping a breach.
Individuals can ask to see, correct or delete their data, withdraw consent, or object to processing. Your systems need to make these requests practical: being able to search for a person’s records across systems, export them, and delete them where required, including from backups on a sensible schedule.
New systems that process personal data in ways likely to create high risk, such as large-scale monitoring or sensitive health and financial data, call for a Data Protection Impact Assessment first. Building privacy into the design is far cheaper than retrofitting it.
If you are not sure where to begin, these steps cover a lot of ground:
Veltriq Alliance helps organisations put the technical side of NDPA compliance in place: security assessments, access and identity controls, encryption, backup and recovery, logging and monitoring, and staff awareness training. We work alongside your legal or compliance advisers, so policy and technology line up.
If you would like a clear picture of where your systems stand today, get in touch or start with our free 1-minute security self-check.
]]>Here are five signs that your network has reached its limits.
If things feel fine at 8am but crawl by 11am, your network is probably running out of capacity at peak times. Common causes include:
What good looks like: business-grade firewalls and switches with enough throughput for your real peak load, and quality-of-service rules that put business-critical traffic first.
Wi-Fi problems are rarely solved by adding another cheap access point. Poor coverage usually comes from access points in the wrong places, interference between them, or a design that never accounted for walls, floors and the number of devices per room.
What good looks like: a wireless site survey to plan coverage, centrally managed access points that hand devices over smoothly as people move, and separate networks for staff, guests and devices such as printers and cameras.
In Lagos, fibre cuts from roadworks and construction are a fact of life. If your business depends on a single internet link, every cut means hours of lost productivity, missed calls and payments that cannot be processed.
What good looks like: at least two internet links from different providers, ideally using different physical routes, with a firewall or SD-WAN device that fails over automatically. Many businesses pair a fibre link with a wireless or 4G/5G backup, so a cut becomes a non-event that staff barely notice.
On a “flat” network, the guest Wi-Fi, the CCTV recorder, the finance team’s PCs and the server all sit side by side. That is convenient until something goes wrong. One infected laptop or compromised camera can then reach everything else, which is exactly how ransomware spreads.
What good looks like: network segmentation using VLANs and firewall rules, so guests, staff, servers, payment systems and IoT devices are kept apart and can only talk to what they genuinely need.
Network equipment has a lifespan. Once a manufacturer declares a switch, router or firewall end-of-life, it stops receiving security updates. Attackers actively look for these devices, because known vulnerabilities on them will never be fixed.
Ask yourself:
If the answer to any of these is “not really”, it is time for a review.
A good upgrade does not start with buying equipment. It starts with understanding how your business uses the network.
Veltriq Alliance designs and builds business networks across Lagos, from structured cabling and enterprise Wi-Fi to multi-site SD-WAN and firewalls. We work with leading vendors including Cisco, Aruba, Huawei and Ruijie, and we recommend what fits your needs rather than a single brand.
Request a network assessment and we will show you where the bottlenecks and risks are, and what it would take to fix them.
]]>The good news is that both are manageable with the right design. Here is how to approach it.
Reliable power comes from several layers working together. If any one of them is missing or neglected, the whole chain is only as strong as that gap.
An automatic transfer switch (ATS) starts the generator and switches the load over when grid power fails, then switches back when it returns, without anyone needing to be on site. Manual changeover works only when someone is there, awake and quick.
Grid and generator power both fluctuate. Spikes, sags and surges shorten the life of power supplies and can damage equipment outright. An automatic voltage regulator (AVR) and proper surge protection at the distribution board protect everything downstream.
The uninterruptible power supply keeps equipment running during the gap between grid failure and generator start, and during changeovers. For server rooms, choose an online (double-conversion) UPS. It continuously cleans the power your equipment receives, rather than only stepping in when power fails.
When sizing it, consider:
If power cannot be restored before the batteries run out, servers should shut down automatically and cleanly, rather than crashing when the power cuts. Shutdown software connected to the UPS does this, protecting data and preventing corruption.
UPS batteries wear out, and heat wears them out faster. As a rule of thumb, the life of sealed lead-acid batteries roughly halves for every 8 to 10°C above 25°C. Check battery health regularly, run periodic self-tests, and plan replacement before failure rather than after.
Servers and network equipment generate a lot of heat, and Lagos temperatures give you little margin. Common problems include:
What good looks like:
Most server room incidents give warning signs: rising temperature, high humidity, a UPS switching to battery, water on the floor. Environmental monitoring turns those signs into alerts on your phone, so you can act before equipment fails.
A good monitoring setup covers:
Alerts should go by SMS or email to more than one person, with clear escalation if nobody responds.
Power and cooling systems that look fine on paper often fail on the day. Every few months:
Veltriq Alliance designs, builds and maintains server rooms and datacenter infrastructure: racks and containment, UPS and power distribution, precision cooling, and environmental monitoring with real-time alerts. We can also audit an existing room and give you a prioritised list of risks and fixes.
Talk to us about your server room, or read more about our datacenter and infrastructure services.
]]>There is no single right answer. This guide compares the options so you can choose what fits your business.
An in-house IT person or team works only for you. They know your people, your systems and your quirks, and they are physically present when something breaks.
Strengths
Limitations
A managed service provider takes responsibility for your IT under an agreed service level agreement (SLA), usually for a predictable monthly fee.
Strengths
Limitations
| In-house team | Managed services | Co-managed (both) | |
|---|---|---|---|
| Coverage | Office hours, limited by headcount | Extended or 24/7, depending on SLA | Extended, with local presence |
| Skills | Limited to the people you hire | Broad specialist team | Broad, plus internal knowledge |
| Cost | Salaries, training, tools | Predictable monthly fee | Mix of both |
| Monitoring | Often reactive | Proactive by design | Proactive |
| Best for | Large or highly specialised environments | Small and mid-sized organisations | Growing organisations with an IT lead |
Many organisations land in the middle. They keep an internal IT lead who knows the business and handles day-to-day priorities, and use a managed service provider for monitoring, security, out-of-hours cover, projects and specialist skills. The internal team is freed from firefighting, and the business gets depth and resilience it could not afford to build alone.
If you are considering managed support, these questions separate strong providers from weak ones:
Veltriq Alliance provides managed support services for organisations across Lagos: helpdesk and on-site support, proactive monitoring, preventive maintenance, patching, and regular service reviews, all under clear service levels. We also work in a co-managed model alongside existing IT teams.
Get a support proposal tailored to your size and needs, or read more about our managed support services.
]]>