When the Nigeria Data Protection Act (NDPA) was signed into law in June 2023, data protection stopped being a “nice to have” for Nigerian businesses. The Act created the Nigeria Data Protection Commission (NDPC), gave individuals clear rights over their personal data, and attached real penalties to getting it wrong.
Most conversations about the NDPA focus on policies and paperwork. But many of its requirements can only be met with the right technology in place. This article looks at the NDPA from an IT point of view: what it expects, and what you can do about it.
This article is a practical overview, not legal advice. For questions about how the law applies to your organisation, speak to a qualified data protection professional.
Who the NDPA applies to
If your organisation collects or uses information about identifiable people, such as customers, patients, students or your own employees, the NDPA applies to you. That covers almost every business, from banks and hospitals to schools, retailers and professional firms.
Organisations the NDPC classifies as data controllers or processors of major importance have extra obligations, including registering with the Commission and appointing a Data Protection Officer. Penalties for this group can reach the higher of ₦10 million or 2% of annual gross revenue, and the higher of ₦2 million or 2% for others.
What the law asks of your IT
1. Keep personal data secure
The Act requires “appropriate technical and organisational measures” to protect personal data against loss, misuse and unauthorised access. It names safeguards such as encryption and pseudonymisation, and expects you to test that your controls actually work.
In practice, that means:
- Access control: staff only see the data they need for their job, with multi-factor authentication on email, VPNs and key systems.
- Encryption: on laptops, mobile devices, backups, and data moving between sites.
- Patching and endpoint protection: to close the gaps attackers use most often.
- Logging: so you can see who accessed what, and when.
2. Be ready to report a breach within 72 hours
If a personal data breach is likely to put people at risk, you must notify the NDPC within 72 hours of becoming aware of it, and tell affected individuals without undue delay when the risk is high.
Seventy-two hours is not long. You can only meet it if you can detect a breach quickly and understand its scope: which systems, which data, how many people. Centralised logging, alerting on suspicious activity, and a written incident response plan make the difference between a controlled response and a scramble.
3. Know where personal data lives
You cannot protect, report on or delete data you cannot find. Personal data tends to spread: into shared drives, email attachments, spreadsheets on laptops, old backups and cloud apps that nobody approved.
A data map records what personal data you hold, where it is stored, who can access it and how long you keep it. It underpins almost every other obligation, from answering a subject access request to scoping a breach.
4. Respect people’s rights
Individuals can ask to see, correct or delete their data, withdraw consent, or object to processing. Your systems need to make these requests practical: being able to search for a person’s records across systems, export them, and delete them where required, including from backups on a sensible schedule.
5. Assess high-risk processing before you start
New systems that process personal data in ways likely to create high risk, such as large-scale monitoring or sensitive health and financial data, call for a Data Protection Impact Assessment first. Building privacy into the design is far cheaper than retrofitting it.
A practical starting checklist
If you are not sure where to begin, these steps cover a lot of ground:
- Map your personal data: systems, locations, owners and retention periods.
- Turn on multi-factor authentication for email, remote access and admin accounts.
- Encrypt laptops and backups, and make sure at least one backup copy is offline or immutable.
- Review access rights: remove leavers, shared accounts and unnecessary admin rights.
- Centralise logs and set up alerts for unusual logins and large data transfers.
- Write a one-page breach response plan with names, phone numbers and first steps.
- Train your staff to recognise phishing, which is still the most common way in.
- Check your suppliers: any provider handling personal data for you must protect it too.
How we can help
Veltriq Alliance helps organisations put the technical side of NDPA compliance in place: security assessments, access and identity controls, encryption, backup and recovery, logging and monitoring, and staff awareness training. We work alongside your legal or compliance advisers, so policy and technology line up.
If you would like a clear picture of where your systems stand today, get in touch or start with our free 1-minute security self-check.