The law in brief
The Nigeria Data Protection Act 2023 sets the rules for how organisations collect and use personal data, and established the Nigeria Data Protection Commission to enforce them. If you hold information about customers or staff, it applies to you.
The core principles
- Have a lawful reason, such as consent or a contract, for collecting personal data.
- Collect only what you need, and only for the purpose you stated.
- Keep it accurate, and don't keep it longer than necessary.
- Protect it with appropriate security.
- Respect people's rights to see, correct and delete their data.
When something goes wrong
If a breach is likely to put people's rights at risk, the Act requires you to notify the Commission promptly, within 72 hours of becoming aware of it, and in serious cases to tell the people affected too.
“Good data protection is mostly good housekeeping: know what you hold, why, and who can see it.”
Practical first steps
- List the personal data you collect and where it's stored.
- Publish a clear privacy notice.
- Limit access to people who need it, and use strong passwords.
- Agree a simple plan for handling a breach.
This article is general information, not legal advice. For your specific obligations, check the Commission's guidance or speak to a lawyer.