Who the law applies to
The Nigeria Data Protection Act 2023 applies to organisations that collect or use personal data about people in Nigeria. That includes the clinic that keeps patient files, the school that keeps parent phone numbers and the shop that sends promotions on WhatsApp.
Larger organisations, or those that handle sensitive data in volume, carry extra duties such as registration and annual audits. Smaller ones still need a lawful basis for what they do and a clear notice that tells people about it.
Step one: write down what you hold
List the kinds of personal data you collect, where it is stored, who can see it and how long you keep it. A spreadsheet is enough. Most companies discover data they had forgotten about, such as old CVs in an email inbox or customer lists on a former employee’s phone.
Four steps: map your data, publish a plain notice, sign vendor agreements, plan for a breach.
Step two: tell people plainly
Publish a privacy notice that matches what you really do. It should say what you collect, why, who you share it with and how people can ask for a copy or ask you to delete it. Short and accurate is better than long and copied.
Step three: control your vendors
If a payroll provider, cloud host or marketing agency handles personal data for you, you need a written agreement that limits what they can do with it. We keep a short form that most vendors sign without argument.
Step four: plan for a bad day
Decide now who will lead if data is lost or stolen, how you will contain it and when you must tell the regulator and the people affected. A one-page plan, rehearsed once a year, is worth more than a binder nobody reads.
If you would like help, our starter pack covers all four steps for a small company in about three weeks, at an example fixed fee of ₦700,000.
