Introduction: Why the NDPA 2023 Matters Right Now
Data is power, and in 2023, Nigeria put real legal weight behind protecting it. Fail to comply, and your business could face fines, audits, and serious reputational damage.
Whether you’re a digital business, a developer with access to user data, or an entrepreneur building an online presence, how you collect and handle personal information is now under strict legal scrutiny. The Nigeria Data Protection Act 2023 (NDPA) goes beyond rebranding the NDPR; it establishes a full-fledged data privacy law with enforceable obligations, real penalties, and a brand-new regulatory watchdog: the Nigeria Data Protection Commission (NDPC).
For the first time, Nigeria has a structured data protection framework that aligns with global standards, such as the GDPR, while also being tailored to local realities and needs. The NDPA supports the national vision outlined in Nigeria’s Digital Economy Policy, as developed by the Federal Ministry of Communications. This means:
- You need clear consent before using personal data
- Individuals have the right to access, correct, or delete their data
- Your business can be fined if it doesn’t comply
This guide breaks it all down in plain English and shows precisely what businesses, startups, and professionals need to do. It’s written for Nigerian operators who want to stay compliant, earn customer trust, and avoid costly mistakes.
As the starting point in our NDPA 2023 series, we’ll walk you through:
- Who the law covers and what it expects
- The core data protection principles to build into your business
- The rights of Nigerians under this law
- Penalties, enforcement, and practical next steps
We’ve also linked to other in-depth articles for founders, marketers, HR teams, and anyone handling personal data in Nigeria:
- Nigeria Data Protection Act 2023: Key Features Transforming Data Protection in Nigeria
- Data Subject Rights: Your Digital Shield in Nigeria’s Data Protection Landscape
- Nigeria Data Protection Commission (NDPC): Guardians of Digital Privacy
- Data Protection Compliance in Nigeria: Strategies for Businesses to Secure Data and Avoid Penalties
- NDPA vs GDPR: How Nigeria Aligns with International Data Protection Standards
Let’s get started – because in today’s Nigeria, protecting personal data is now a legal and business imperative.
I. The 7 Core Principles of Data Protection in Nigeria
At the heart of the Nigeria Data Protection Act 2023 is a set of seven foundational principles. These aren’t just theoretical ideals; they define how you must handle personal data, whether you’re a fintech startup, an e-commerce platform, or a local HR consultancy managing employee records.
Think of these principles as your business’s data protection compass. When in doubt, these are the standards you should measure your practices against.
1. Lawfulness, Fairness, and Transparency
Only collect data for a legitimate reason, use it fairly, and be clear about your intentions. That means no sneaky forms, buried consent boxes, or vague privacy policies.
Example: If you’re collecting emails for a newsletter, tell people exactly what they’re signing up for and how often you’ll contact them.
2. Purpose Limitation
Only use personal data for the reason you collected it. If you collected data to process a job application, you can’t turn around and add that person to your company newsletter list.
3. Data Minimization
Don’t collect more information than you truly need. If you’re offering free resources or sign-ups, asking for just name and email might be enough. There is rarely a reason to request personal information like date of birth or phone number unless it’s absolutely essential.
4. Accuracy
Ensure the data you collect is accurate and provide users with a way to update it. Inaccurate or outdated data could lead to incorrect decisions, billing errors, or even legal disputes.
5. Storage Limitation
You can’t keep personal data forever “just in case.” The NDPA expects you to define how long you’ll keep data and securely dispose of it when it’s no longer needed.
Example: Delete job applicant data after 6 months if the candidate isn’t hired unless they consent to being kept on file for future roles.
6. Integrity and Confidentiality (Security)
You must protect personal data from unauthorized access, leaks, or loss. That includes securing physical files, encrypting digital records, and using strong passwords or access controls.
7. Accountability
This is a big shift from the old NDPR. Under the NDPA, it’s not enough to say you intend to follow the rules you must show evidence that you are following them. This includes having documented policies, training staff, and keeping records of how you process data (known as ROPA – Record of Processing Activities).
✅ Key Change: Unlike the NDPR, the NDPA elevates Accountability as a standalone principle. You’re now expected to demonstrate compliance, not just claim it.
II. Your Rights as a Data Subject (And What They Mean in Plain English)
The NDPA 2023 doesn’t just protect data; it empowers people. Every Nigerian now has legally enforceable rights over their personal information, and your business must be prepared to respect those rights.
These aren’t abstract legal concepts. They’re practical expectations that affect how you handle customer service, marketing, internal data management, and more.
Let’s break them down.
1. Right to Be Informed
You have the right to know why your data is being collected, how it will be used, and with whom it may be shared before it’s collected. This includes being presented with a clear and accessible privacy notice whenever data is gathered.
2. Right to Access
Individuals can request to see the personal data you hold about them, and you must provide it in a timely, clear format.
Think of it like someone asking, “What do you know about me?” and you have to show your cards. You should typically respond within one month of the request.
3. Right to Object
A person can say, “Stop using my data for this purpose,” and you must comply, especially if the objection relates to direct marketing.
If a user unsubscribes from marketing emails, continuing to send them could trigger a violation.
4. Right to Correction
If someone’s data is incorrect or incomplete, they can request that you correct it. This is particularly important in areas like HR, finance, and e-commerce.
5. Right to Deletion (Right to Be Forgotten)
People can request that their data be erased, and in many cases, you’re legally obligated to do so. This applies if the data is no longer needed or was collected without proper consent.
Example: A user closes their account and requests full deletion of their records. If you don’t have a lawful reason to retain the data, you must delete it.
6. Right to Data Portability
Users can ask for their data in a format they can reuse or ask you to transfer it directly to another provider.
This right is especially relevant in sectors like fintech, telecoms, or health tech where users may switch service providers.
7. Right to Restrict Processing
If there’s a dispute about how their data is used, a person can ask you to stop processing it temporarily. You’re expected to pause processing until the issue is resolved.
Example: A customer disputes a charge and asks that their payment details not be used while the issue is under review. You must temporarily suspend processing related to that transaction.
8. Right to Withdraw Consent
If you’re relying on user consent to collect or use data, that consent can be withdrawn at any time, and you must immediately stop using the data for that purpose.
III. The Role of the Nigeria Data Protection Commission (NDPC)
1. It’s Truly Independent
Unlike the old system under NITDA (Nigeria’s tech development agency), the NDPC operates as a standalone Commission. It’s structured to function like regulatory bodies in other sectors, such as the NCC (telecoms) or SEC (capital markets).
This independence lends it credibility, focus, and the mandate to enforce without political interference, ensuring that enforcement decisions are based on the law, not external influence.
For official guidance, licensing, or reporting obligations, businesses can consult the Nigeria Data Protection Commission’s website.
2. It Has Teeth – Not Just Talk
The NDPC can:
- Conduct data protection audits and investigations
- Require organizations to submit compliance reports
- Issue compliance notices or enforcement orders
- Impose financial penalties (see next section)
- Approve codes of conduct for sectors like fintech, education, and health
- Authorize cross-border data transfers based on adequacy
In short: this is not a body you can ignore or treat like a checkbox.
3. It’s Building a Local Compliance Ecosystem
The NDPC also licenses:
- Data Protection Compliance Organizations (DPCOs) – third parties that help companies implement NDPA requirements
- Data Controllers/Processors of Major Importance (DCMIs/DPMIs – typically larger organizations processing significant volumes or sensitive data) – organizations that must register directly with the Commission due to their size or risk profile
IV. Penalties for Non-Compliance: What’s at Stake for Your Business
⚖️ Tier 1: Major Data Controllers/Processors (generally defined by data volume, type of data, annual turnover, or critical sector importance)
- Fines: Up to 2% of annual gross revenue OR ₦10 million, whichever is higher.
⚖️ Tier 2: Minor Data Controllers/Processors
- Fines: Up to 2% of annual gross revenue OR ₦2 million, whichever is higher.
🚨 Real Risks Beyond Fines
- NDPC may publish your violation – affecting your brand reputation
- You could face civil lawsuits from individuals whose data rights were breached
- Customers, vendors, or investors may reconsider working with a non-compliant company
V. NDPA Compliance Checklist for Nigerian Businesses
✅ Appoint a Data Protection Lead or DPO (if required by your size or risk profile)
✅ Audit the personal data you collect – what, why, how, and where it’s stored
✅ Update your privacy policy to reflect NDPA principles in clear language
✅ Put consent mechanisms in place (opt-in forms, cookies, newsletters, etc.)
✅ Enable rights requests – make it easy for users to access, correct, or delete data
✅ Train staff who handle personal data – HR, marketing, IT, sales, support
✅ Secure your data systems (encryption, backups, access control)
✅ Document your data processing activities (ROPA)
✅ Set up a breach notification plan – who does what, and report qualifying breaches to the NDPC within 72 hours of awareness, especially where the risk to individuals is high
✅ Review contracts with third-party processors – conduct due diligence and ensure signed Data Processing Agreements (DPAs) are in place
VI. What This Means for Startups and SMEs in Nigeria
Startups and small businesses aren’t exempt, but your responsibilities depend on the type of data you handle and the level of risk it poses.
The NDPA is designed to be risk-based. That means while the core principles apply to everyone, the extent of your obligations depends on your size and the type of data you process.
Here’s what small businesses need to know:
- You may not need a full-time Data Protection Officer (DPO) unless you handle sensitive data or operate at scale
- If you only process basic customer information (e.g., names, emails), your compliance can be simpler but you still need a privacy policy and consent process
- You must respect user rights (access, correction, deletion, etc.) and know how to respond to those requests
- You should document your data handling, even if it’s just a spreadsheet or shared Google Doc
Practical, Low-Cost Ways to Comply:
- Use privacy policy generators tailored for Nigerian businesses
- Train one staff member to serve as your data protection lead
- Add simple consent checkboxes to forms or WhatsApp Business messages
- Use tools like Google Forms with explicit opt-in text for data collection, and free compliance tools like the OWASP Top 10 security checklist for securing web applications
VII. Final Thoughts – Why Compliance Builds Trust
At its core, the Nigeria Data Protection Act 2023 is about more than checking boxes; it’s about building trust in a digital economy.
For businesses, this law is an opportunity:
- To build customer loyalty by demonstrating respect for privacy
- To stand out as a trustworthy brand
- To strengthen customer relationships
- To reduce legal risk and future-proof your operations
VIII. Frequently Asked Questions (FAQ)
Ready to Take Action? Explore Our Expert Resources
👉 Want practical help with compliance, checklists, or internal training? Explore PlanetWeb’s NDPA resources and expert guides.
Explore the rest of the NDPA 2023 Series:
- Nigeria Data Protection Act 2023: Key Features Transforming Data Protection in Nigeria
- Data Subject Rights: Your Digital Shield in Nigeria’s Data Protection Landscape
- Nigeria Data Protection Commission (NDPC): Guardians of Digital Privacy
- Data Protection Compliance in Nigeria: Strategies for Businesses to Secure Data and Avoid Penalties
- NDPA vs GDPR: How Nigeria Aligns with International Data Protection Standards
