Data Protection Impact Assessments in Nigeria: When You Need One

Table of Contents

Data Protection Impact Assessments in Nigeria: When You Need One and How to Do It Right

Most Nigerian businesses that have heard of DPIAs treat them as something large corporations worry about. That assumption has a cost.

A Data Protection Impact Assessment is not bureaucratic paperwork. It is the mechanism the NDPA and GAID use to catch privacy problems before a product launches, not after the NDPC comes knocking. Skipping it is one of the most common compliance gaps the regulator encounters.

It explains what a DPIA actually does, when your business is legally required to conduct one, and what the process looks like in practice across different sectors.

This article is part of PlanetWeb’s NDPA compliance series. For the foundational framework, see our NDPA Compliance Guide for Nigerian Businesses. For a practical compliance strategy, see our Data Protection Compliance Strategies guide.

What a DPIA Is (and What It Isn’t)

A Data Protection Impact Assessment is a structured process for identifying the privacy risks associated with a specific data processing activity and deciding what to do about them before you begin.

The key word is before. A DPIA is not a retrospective review of data you already collect. It is a prospective assessment of something you are planning to do. If you are launching a new product feature that involves profiling customers, deploying biometric verification, or building a system that makes automated decisions about people, the DPIA comes first.

It is also not the same as a data audit. A data audit tells you what personal data your organisation currently holds, where it lives, and who has access to it. A DPIA asks a different question: if we carry out this specific processing activity, what could go wrong for the people whose data we are using, and are we prepared to manage those risks?

What a DPIA produces is a documented record of that risk assessment, the mitigations you have put in place, and the reasoning behind your decisions. That documentation is what the NDPC will ask to see if your processing activity is ever audited or a complaint is raised.

When You Are Required to Conduct One

Under the NDPA 2023 and GAID, a DPIA is mandatory before beginning any processing activity that is likely to result in a high risk to the rights and freedoms of individuals. The NDPC does not leave this entirely open to interpretation. There are specific processing categories generally considered high-risk and requiring a DPIA.

Automated decision-making with significant effects. Any system that makes decisions about people without meaningful human review when those decisions have legal or similarly significant consequences requires a DPIA. This covers credit scoring models, loan approval algorithms, insurance underwriting systems, and employee performance management tools that generate automated outputs affecting pay or promotion. Under the NDPA, individuals have the right to request human review of automated decisions that affect them, a right covered in our Data Subject Rights in Nigeria guide.

Biometric data processing. Collecting or using fingerprints, facial recognition data, voice patterns, or other biometric identifiers is inherently high-risk under the NDPA. The sensitivity of biometric data and the fact that it cannot be changed if compromised place it in the highest processing risk category. Any business deploying biometric verification, whether for customer onboarding, access control, or attendance management, needs a DPIA before going live.

Large-scale processing of sensitive data. Health records, financial data, religious or political beliefs, and data revealing racial or ethnic origin are all sensitive categories under the NDPA. Processing these at scale, whether you are a healthtech platform managing thousands of patient records or an HR system processing employee medical information, triggers the requirement.

Systematic monitoring. CCTV systems that cover public or semi-public spaces, location tracking of employees or customers, and behaviour tracking across digital platforms all count as systematic monitoring. The scale matters: a single CCTV camera in a small retail store is different from a network of cameras with facial recognition capability, but the threshold is lower than most businesses assume.

Processing children’s data. Where a platform or service is directed at or likely to be accessed by children, additional protections apply. A DPIA is required before any large-scale or systematic processing of data relating to minors.

Combining datasets from multiple sources. Building customer profiles by combining data from different collection points, such as your CRM, website analytics, payment processor, and marketing platform, creates risks that each dataset individually would not. The aggregation itself can transform low-risk data into high-risk processing.

If any of these apply to something your business currently does or is planning to do, a DPIA is not optional.

What Happens If You Skip It

The most direct consequence is exposure to NDPC enforcement. The Commission has made clear that it will audit processing activities against the documentation businesses are required to maintain, and the absence of a DPIA for high-risk activities is a compliance failure in itself, separate from whether any harm has resulted. For a fuller picture of how the Commission operates and its enforcement powers, see our overview of the Nigeria Data Protection Commission.

Beyond the NDPC, there are practical business risks that receive less attention.

If your business suffers a data breach involving a high-risk processing activity for which no DPIA was conducted, your liability position is materially worse. The absence of a prior risk assessment signals to the regulator, and potentially to courts, that the organisation did not take reasonable steps to prevent foreseeable harm.

For businesses seeking investment or entering enterprise procurement processes, DPIAs are increasingly part of due diligence. A fintech pitching to international investors or a healthtech platform onboarding a hospital network will face questions about privacy risk governance. Not having documented DPIAs for high-risk processing is a gap that serious buyers and investors will notice.

For businesses that process data on behalf of clients, the contractual risk is equally real. Your clients bear responsibility as data controllers for what happens to their customers’ data. If you cannot show that you assessed and managed the privacy risks, they are exposed, and they will hold you accountable.

How to Conduct a DPIA: Step by Step

The NDPC provides a free DPIA template on its website at ndpc.gov.ng. The template gives you the structure. What follows is what that structure actually requires you to work through.

Step 1: Define the scope of the processing activity. Be specific about what you are assessing. A DPIA for a credit scoring feature is not the same as a DPIA for the entire loan application process. Define the data inputs, the processing logic, the outputs, and the people affected.

Step 2: Describe the data flows. Map exactly what data is collected, from whom, how it is stored, who can access it, how long it is retained, and whether it is shared with third parties or transferred outside Nigeria. This step often reveals data flows the compliance function did not know existed.

Step 3: Assess necessity and proportionality. Ask whether the processing is necessary for the stated purpose and whether a less intrusive approach would achieve the same result. The NDPA’s data minimisation principle applies: if you can achieve the objective with less data, you should.

Step 4: Identify the risks. For each aspect of the processing activity, consider what could go wrong for the people affected. Risks include unauthorised access, data used beyond its consented purpose, errors in automated decisions, and data retained longer than necessary.

Step 5: Assess likelihood and severity. Not all risks are equal. Score each identified risk on likelihood and severity, and document your reasoning. A low-probability, low-impact risk needs less mitigation than one that is plausible and consequential.

Step 6: Define and implement mitigations. For each significant risk, document what technical or organisational measures you are putting in place to reduce it. Encryption, access controls, data minimisation, pseudonymisation, staff training, and contractual safeguards with vendors are all examples. The mitigation needs to be specific and implementable, not a vague statement of intent.

Step 7: Document the residual risk and the decision. After mitigations, some residual risk will remain. Document that level and the decision made to proceed, pause, or escalate. If the residual risk is high, the NDPA requires prior consultation with the NDPC before proceeding with the processing activity. This is not discretionary: where a DPIA indicates that high residual risk remains despite mitigation measures, you must consult the Commission before going ahead.

Step 8: Set a review schedule. A DPIA is not a one-time document. It needs to be reviewed whenever the processing activity changes in a material way: new data inputs, new third-party integrations, a change in the scale of processing, or new regulatory guidance that affects the risk assessment.

Sector Spotlight: High-Risk Industries in Nigeria

Fintech and Financial Services

Fintech businesses in Nigeria operate in one of the highest-risk categories for DPIA requirements. Credit scoring, loan approval algorithms, transaction monitoring for fraud detection, and open banking data sharing all trigger the requirement. The 72-hour breach notification window applies to both the NDPC and the CBN simultaneously, which makes prior risk documentation even more important when an incident occurs. For guidance on dual compliance with international frameworks, see our NDPA vs GDPR comparison.

Automated decisioning in lending is a particular area of focus. If your platform rejects a loan application based on an algorithm, the data subject has rights to understand the basis of that decision and to request human review. A DPIA conducted before launch should have mapped exactly how those rights would be handled.

Healthtech and Healthcare Providers

Patient data is sensitive personal data under the NDPA by definition, and most healthcare data processing will require a DPIA. Telemedicine platforms, electronic health record systems, diagnostic applications, and any platform sharing patient data with third parties, whether for clinical, research, or insurance purposes, are within scope.

Role-based access controls and audit logging are not just good practice in healthcare: they are part of the risk mitigation that a DPIA in this sector needs to demonstrate. Our Electronic Health Records guide for Nigerian clinics covers implementation considerations in more depth.

HR Technology

Employee monitoring, performance management algorithms, biometric-based attendance systems, and tools that aggregate employee data to generate assessments all require DPIAs. The employment relationship does not reduce these obligations. Employees have the same data rights as customers, and the power imbalance in employment makes genuinely free consent harder to establish, which affects the lawful basis analysis.

E-Commerce and Retail Platforms

Behavioural profiling, where a platform tracks what users browse, click, and purchase to build individual profiles for targeting, is large-scale processing that will typically require a DPIA. The combination of purchase history, location data, browsing behaviour, and demographic information creates a profile that goes well beyond what any individual data point would suggest. Platforms that use this kind of profiling for personalised pricing or dynamic offers face additional scrutiny.

Common Mistakes Nigerian Businesses Make

Conducting the DPIA after the product has launched. This is the most common mistake. The DPIA is retrospectively assembled to satisfy an audit rather than genuinely informing design decisions. A DPIA that happens after launch cannot achieve its purpose, and an auditor familiar with the requirement will recognise a document assembled in retrospect.

Treating it as a one-time document. A DPIA completed in 2023 for a processing activity that has since changed in scope, scale, or technical implementation is not current. If the underlying processing has changed materially, the DPIA needs to be updated.

Completing the template without genuine risk analysis. The NDPC template provides fields to complete. Completing them with vague, non-specific language does not satisfy the requirement. The risk assessment section needs to identify actual, specific risks relevant to the particular processing activity, not generic statements about data protection.

No follow-through on mitigations. A DPIA that identifies risks and proposes mitigations but never documents whether those mitigations were actually implemented is incomplete. The document needs to reflect what was actually done, not just what was planned.

Keeping it siloed in the compliance function. A DPIA that the product team, engineering team, or vendor management function has never seen is unlikely to drive the design changes it identifies as necessary. DPIAs work when the outputs inform real decisions. That requires the findings to reach the people who can act on them.

Where Professional Help Makes Sense

For straightforward processing activities, an in-house team with access to the NDPC’s free template and a clear understanding of the NDPA can conduct a credible DPIA. The foundational steps do not require external support if the knowledge is present internally.

Where professional guidance genuinely reduces risk is in complex or high-stakes contexts: novel AI-driven processing, large-scale biometric systems, multi-jurisdiction data flows, or any situation where the residual risk after mitigation remains unclear.

PlanetWeb works with Nigerian businesses on data protection readiness, including DPIA design, risk assessment, and compliance documentation. If you are preparing to launch a high-risk processing activity and want to ensure your assessment is thorough and defensible, get in touch.

Do You Need a DPIA? A Quick Reference

Use this as a starting point. If your answer to any of the following is yes, a DPIA is required before you begin.

Your processing involves:

Automated decisions with significant effects on individuals (credit, insurance, employment)
Biometric data of any kind
Health, financial, or other sensitive personal data at scale
Systematic monitoring of individuals (CCTV, location tracking, behaviour analytics)
Children’s data processed systematically or at scale
Combining data from multiple sources to build individual profiles
A new technology or processing method where the privacy risks are not well understood

Even if none of the above apply, a DPIA is good practice for any new processing activity you have not previously assessed. Working through the steps surfaces questions about data flows, access controls, and vendor responsibilities that are worth answering regardless.

Frequently Asked Questions

Is a DPIA required for small businesses?

Yes, if the processing activity falls into a high-risk category. The size of the business is not the determining factor under the NDPA. A small fintech using automated credit scoring or a small clinic processing patient data at scale has the same DPIA obligation as a large enterprise doing the same thing.

Is a DPIA the same as a data audit?

No. A data audit maps what personal data your organisation currently holds. A DPIA assesses the privacy risks of a specific processing activity you are planning to begin. They serve different purposes and are both required under a mature compliance programme.

Who is responsible for conducting the DPIA?

The data controller is responsible. In practice, this means your DPO, compliance officer, or designated compliance lead should own the process, with input from the product, engineering, and legal teams involved in the processing activity.

Do I need to send my DPIA to the NDPC?

Not automatically. DPIAs are internal documents that must be available on request during an audit. However, if your DPIA concludes that the residual risk of a processing activity remains high after mitigation, you are required to consult the NDPC before proceeding.

Does a DPIA expire?

A DPIA does not have a fixed expiry date, but it should be reviewed and updated whenever the underlying processing activity changes materially. Changes in data inputs, processing logic, scale, third-party integrations, or applicable regulatory guidance can all require a review.

Can I use a template for my DPIA?

Yes. The NDPC provides a free DPIA template at ndpc.gov.ng. The template provides the required structure. The quality of the assessment depends on how thoroughly and specifically you work through each section for your particular processing activity.

What happens if I launch a high-risk processing activity without a DPIA?

You are in breach of the NDPA and GAID requirements. If the NDPC audits your organisation or a complaint is raised in connection with that processing activity, the absence of a DPIA is a compliance failure independent of whether any harm occurred. It also weakens your position significantly if a breach does occur.

Do DPIAs apply to existing processing activities or only new ones?

The formal requirement applies to new high-risk processing activities before they begin. However, if your organisation is currently running a high-risk processing activity for which no DPIA has ever been conducted, it is strongly advisable to complete one now. An NDPC auditor will expect to see DPIA documentation for any processing activity that falls within the high-risk categories.