The Nigeria Data Protection Act 2023: what it means for small businesses
The Nigeria Data Protection Act 2023 sets out how organisations must handle personal data, and established the Nigeria Data Protection Commission to enforce it. It applies to most businesses that collect information about customers, employees or other individuals.
Key obligations
- Have a lawful basis, such as consent or the performance of a contract, for collecting and using personal data.
- Collect only what you need, and keep it only as long as necessary.
- Tell people how their data will be used, usually through a privacy notice.
- Keep personal data secure and limit who can access it.
- Respect individuals’ rights to access, correct and request deletion of their data.
- Report certain personal data breaches to the Commission promptly.
Practical first steps
- List the personal data your business holds and where it is stored.
- Publish a clear privacy notice on your website and forms.
- Review contracts with service providers who handle data for you.
- Train staff on handling personal data and reporting breaches.
Some organisations are classed as data controllers or processors of major importance and have additional duties, including registration with the Commission. We can help you work out what applies to your business and put the right policies in place.
The information on this website is for general information only and is not legal advice. Contacting us through this website does not create a lawyer–client relationship. Please do not send confidential information until we have agreed to act for you.