--- title: "Data Protection Impact Assessments in Nigeria: When and How" url: https://planetweb.ng/data-protection-impact-assessments-in-nigeria/ date: 2026-03-03T13:16:36+00:00 modified: 2026-09-11T01:47:29+00:00 lang: en_US --- # Data Protection Impact Assessments in Nigeria: When and How ## Data Protection Impact Assessments in Nigeria: When You Need One A Data Protection Impact Assessment (DPIA) can become a legal requirement long before a new product or service reaches customers. For a business introducing automated decision-making, handling sensitive data, monitoring people, or deploying new technology, the assessment may need to happen before that processing begins, not after. This article explains what a DPIA does, when a business is legally required to conduct one, and what the process looks like in practice across different sectors. It is part of PlanetWeb's GAID compliance series. For the foundational framework, see *[GAID Nigeria Data Protection Directive: What Every Business Must Know](https://planetweb.ng/gaid-nigeria-data-protection-directive/)*. For a practical compliance strategy, see *[Data Protection Compliance Strategies](https://planetweb.ng/data-protection-compliance-in-nigeria-strategies/)*. ## What a DPIA Is (and What It Is Not) A Data Protection Impact Assessment is a structured process for identifying the privacy risks associated with a specific data processing activity and deciding what to do about them before that activity begins. Section 28 of the Nigeria Data Protection Act (NDPA) establishes the DPIA obligation, with [GAID Article 28 and Schedule 4](https://ndpc.gov.ng/wp-content/uploads/2025/07/NDP-ACT-GAID-2025-MARCH-20TH.pdf) providing the operational framework: when a DPIA is mandatory, what it must contain, and what happens afterwards. A DPIA is prospective rather than retrospective. It assesses something an organisation is planning to do, launching a feature that profiles customers, deploying biometric verification, or building a system that makes automated decisions about people, before that processing begins. It is also not the same as a data audit. A *[data audit](https://planetweb.ng/data-protection-compliance-in-nigeria-strategies/)* establishes what personal data an organisation currently holds, where it lives, and who has access to it. A DPIA asks a narrower, forward-looking question: if this specific processing activity goes ahead, what could go wrong for the people whose data is involved, and what will the organisation do about it? What a DPIA produces is a documented record of that risk assessment, the mitigations put in place, and the reasoning behind the decisions made. That documentation gives an organisation evidence of how it assessed and addressed the risks if the processing is later reviewed by the NDPC. ## When a DPIA Is Required GAID identifies a range of circumstances in which a DPIA is required and sets out the relevant criteria. ### Profiling and Automated Decision-Making Evaluation or scoring of individuals, and automated decision-making with legal or similarly consequential effects, both trigger the requirement. This covers credit scoring models, loan approval algorithms, insurance underwriting systems, and employee performance tools that generate automated outputs affecting pay or promotion. *[Data Subject Rights in Nigeria](https://planetweb.ng/data-subject-rights-in-nigeria/)* covers the related right to request human review of an automated decision. ### Systematic Monitoring and Surveillance CCTV systems monitoring people over time, location tracking of employees or customers, and behaviour tracking across digital platforms all count as systematic monitoring. Deploying surveillance cameras in public areas is a separate trigger. ### Sensitive Data and Vulnerable Data Subjects Processing sensitive or highly personal data triggers the requirement, as does processing involving vulnerable data subjects, which includes children. GAID's Schedule 6 sets out vulnerability indices the Commission uses to help identify which data subjects warrant this heightened protection. ### Innovative Technology and New Processing Methods Deploying innovative processes, applications, or new technological or organisational solutions that pose a significant risk to privacy requires a DPIA, as does developing software intended to enable communication with data subjects. In practice, this covers things like a new AI-driven recommendation engine, a biometric authentication method the business has not used before, or a chatbot built to interact directly with customers or employees. ### Specified Sectors and Activities Several activities are named directly as triggers: financial services involving personal data processed through digital devices, healthcare services, e-commerce services, educational services involving student or pupil records, and hospitality services. The law also lists a legal instrument or policy requiring processing of the general public's personal data. ### Cross-Border Data Transfer Transferring personal data outside Nigeria is itself one of the listed triggers, independent of what the underlying processing activity is. This applies regardless of the destination's adequacy status or which transfer mechanism is relied on, and it connects directly to the cross-border transfer requirements covered in Step 2 of the process below. If any of these apply to something a business currently does or is planning to do, a DPIA is required. The list is only part of the test, however: GAID also requires a DPIA for any processing likely to result in high risk to a data subject's rights and freedoms, even outside these named circumstances, based on its nature, scope, context, and purpose. ## What Happens If You Skip It Skipping a required DPIA carries a specific consequence beyond generic enforcement exposure: failure, refusal, or negligence in conducting one may result in a restriction on all platforms where data subjects have contact with the organisation for any transaction involving personal data (Article 28(6)). This sits separate from the broader enforcement powers under Part X of the NDPA. *[GAID Nigeria Data Protection Directive: What Every Business Must Know](https://planetweb.ng/gaid-nigeria-data-protection-directive/)* walks through the wider penalty structure under Section 48. Beyond regulatory exposure, there are practical business risks that receive less attention. A data breach involving a high-risk processing activity for which no DPIA was conducted can make it harder for an organisation to show that it identified and addressed foreseeable privacy risks before processing began. *[Responding to Data Breaches in Nigeria](https://planetweb.ng/responding-to-data-breaches-in-nigeria/)* covers the notification obligations that follow a breach. For businesses seeking investment or entering enterprise procurement, DPIAs are increasingly part of due diligence. A fintech pitching international investors or a healthtech platform onboarding a hospital network will face questions about privacy risk governance, and serious buyers notice gaps like undocumented DPIAs for high-risk processing. For businesses processing data on behalf of clients, the contractual exposure can be equally real. Clients may require evidence that privacy risks have been assessed and managed, and a processor unable to provide that evidence may face contractual, regulatory, or commercial consequences. ## How to Conduct a DPIA: Step by Step The NDPC provides a [free DPIA template](https://ndpc.gov.ng/) at ndpc.gov.ng, built around the structure set out in Schedule 4 of GAID. ### Step 1: Define the Scope Scope needs to be defined precisely. A DPIA for a credit scoring feature is not the same as a DPIA for the entire loan application process. The data inputs, the processing logic, the outputs, and the people affected all need defining upfront. ### Step 2: Map the Data Flows This step covers what data is collected, from whom, how it is stored, who can access it, how long it is retained, and whether it is shared with third parties or transferred outside Nigeria. Where cross-border transfer is involved, this is the point at which the transfer's legal mechanism needs to be identified; *[GAID Nigeria Data Protection Directive: What Every Business Must Know](https://planetweb.ng/gaid-nigeria-data-protection-directive/)* covers what GAID recognises as a valid basis for the transfer. Mapping data flows properly often reveals flows the compliance function did not know existed. ### Step 3: Assess Necessity and Proportionality This asks whether the processing is necessary for the stated purpose and whether a less intrusive approach would achieve the same result. GAID's data minimisation principle applies here: use no more data than the objective genuinely requires. ### Step 4: Identify the Risks For each aspect of the processing activity, this step considers what could go wrong for the people affected: unauthorised access, data used beyond the purpose for which it was collected, errors in automated decisions, and data retained longer than necessary. ### Step 5: Assess Likelihood and Severity Not all risks are equal. Each identified risk needs scoring on likelihood and severity, with the reasoning documented. A low-probability, low-impact risk needs less mitigation than one that is plausible and consequential. ### Step 6: Define and Implement Mitigations For each material risk, the DPIA needs to document the specific technical or organisational measures put in place to reduce it, including encryption, access controls, data minimisation, pseudonymisation, staff training, and contractual safeguards with vendors. The assessment also needs to reflect privacy by design and by default: proactive rather than reactive, privacy as the default setting, full functionality without compromising other safeguards, end-to-end security, and transparency to the people affected. A vague statement of intent does not satisfy this. ### Step 7: Document the Residual Risk After mitigations, some risk typically remains. The DPIA needs to document that residual level and the decision made, to proceed, pause, or escalate internally. ### Step 8: Certify and Submit A DPIA submitted to the Commission must be signed by a duly certified Data Protection Officer (DPO) accredited by the Commission. Its outcome forms part of the organisation's Compliance Audit Return where applicable, and where a DPIA is required, it needs to be carried out and submitted to the Commission ahead of the relevant processing, rather than assembled afterwards to satisfy an audit. ### Step 9: Set a Review Schedule A DPIA is not a one-time document. It should be reviewed when the processing activity changes materially, including through new data inputs, new third-party integrations, a change in scale, or new regulatory guidance affecting the risk assessment. ## Sector Spotlight: High-Risk Industries in Nigeria ### Fintech and Financial Services Fintech businesses sit in one of the highest-risk categories for DPIA requirements. Credit scoring, loan approval algorithms, transaction monitoring for fraud detection, and open banking data sharing all trigger it. *[Comparison of NDPA 2023 and GDPR](https://planetweb.ng/comparison-of-ndpa-2023-and-gdpr/)* covers dual compliance considerations for businesses operating across both frameworks. Automated decisioning in lending is a particular area of focus. Where a platform makes a decision about a loan applicant solely through automated processing, the applicable data subject rights, including the right to human intervention where the NDPA's automated decision-making provisions apply, need to be considered as part of the DPIA conducted before launch. ### Healthtech and Healthcare Providers Patient data is sensitive personal data under the NDPA by definition, and healthcare services are among the activities GAID specifically identifies as requiring a DPIA. Telemedicine platforms, electronic health record systems, diagnostic applications, and any platform sharing patient data with third parties, whether for clinical, research, or insurance purposes, need to assess whether their processing falls within that requirement. In this sector, role-based access controls and audit logging are part of the mitigation a DPIA needs to demonstrate, beyond being general good practice. *[Electronic Health Records in Nigeria](https://planetweb.ng/electronic-health-records-in-nigeria/)* covers implementation considerations for clinics in more depth. ### HR Technology Employee monitoring, biometric attendance systems, performance management algorithms, and tools that aggregate employee data for assessment can trigger the DPIA requirement, depending on how the processing is carried out. The employment relationship does not reduce these obligations. Employees are data subjects and can exercise applicable data protection rights over their employment data, subject to the conditions and limitations that apply to those rights. The power imbalance inherent to employment also makes genuinely free consent harder to establish, which affects the lawful basis analysis. ### E-Commerce and Retail Platforms Behavioural profiling, such as tracking what users browse, click, and purchase to build individual profiles for targeting, falls within the DPIA triggers under GAID regardless of scale. Combining purchase history, location data, browsing behaviour, and demographic information creates a profile that goes well beyond what any individual data point would suggest. ## Common Mistakes Nigerian Businesses Make **Conducting the DPIA after the product has launched.** This is the most common mistake. A DPIA assembled retrospectively to satisfy an audit cannot achieve its actual purpose, and an auditor familiar with the requirement will recognise a document built after the fact. **Treating it as a one-time document.** A DPIA completed years ago for a processing activity that has since changed in scope or technical implementation is no longer current. Step 9 covers what should trigger an update. **Completing the template without genuine risk analysis.** The NDPC's template provides fields to complete, but vague, non-specific language does not satisfy the requirement. The risk assessment needs to identify actual risks relevant to the particular processing activity rather than generic statements about data protection. **No follow-through on mitigations.** A DPIA that identifies risks and proposes mitigations but never documents whether those mitigations were carried out is incomplete. The document should reflect what was implemented, rather than only what was proposed. **Keeping it siloed in the compliance function.** A DPIA the product, engineering, or vendor management teams have never seen is unlikely to drive the design changes it identifies. The findings need to reach the people who can act on them. ## Do You Need a DPIA? A Quick Reference | Processing Activity | DPIA Required? | | --- | --- | | Profiling, scoring, or automated decisions with legal or similar effects | Yes | | Systematic monitoring, including CCTV or location tracking | Yes | | Sensitive data, or data involving vulnerable individuals such as children | Yes | | Biometric identifiers | Yes, as sensitive data under the NDPA | | Innovative technology or new processing methods with significant privacy risk | Yes | | Financial services, healthcare, e-commerce, education, or hospitality involving digital processing | Yes, these sectors are named directly in Article 28(3) | | Cross-border data transfer | Yes, listed as its own trigger regardless of the underlying activity | | A new processing activity not previously assessed, even outside these categories | Potentially yes, GAID's general high-risk test applies even where no specific category fits | ## Get Help With DPIAs For straightforward processing activities, an in-house team with the NDPC's free template and a clear understanding of the NDPA can conduct a credible DPIA. Where professional guidance genuinely reduces risk is in complex or high-stakes contexts: novel AI-driven processing, large-scale biometric systems, multi-jurisdiction data flows, or situations where the residual risk after mitigation remains unclear. If it's still unclear whether your business needs a DPIA for something it's planning, that's a reasonable place to start rather than a sign you're behind. Our [IT consulting](https://planetweb.ng/services/it-consulting-services/) work covers DPIA design, risk assessment, and compliance documentation. [Get in touch](https://planetweb.ng/free-it-consultation/) to talk through what you're planning to launch. ## Frequently Asked Questions Is a DPIA required for small businesses? Yes, if the processing activity meets the DPIA requirement under GAID. Business size is not the determining factor. A small fintech using automated credit scoring can have the same DPIA obligation as a large enterprise carrying out the same processing. Is a DPIA the same as a data audit? No. A data audit maps what personal data an organisation currently holds. A DPIA assesses the privacy risks of a specific processing activity being planned. Both are part of a mature compliance programme, but they answer different questions. Does a DPIA need to be sent to the NDPC? Yes, where the GAID requires a DPIA. It must be submitted to the Commission before the relevant processing begins, and its outcome forms part of the organisation’s annual Compliance Audit Return. Does a DPIA expire? It has no fixed expiry date, but it should be reviewed when the processing changes materially. New data inputs, changes in scale, and new third-party integrations are examples of changes that may require a review. What happens if a high-risk processing activity launches without a DPIA? The organisation is in breach of the NDPA’s DPIA requirement, which may result in a restriction on the platforms through which it has contact with data subjects, separate from the wider enforcement powers available to the Commission.