Tag Archive for: NDPA 2023

Nigeria’s National Data Protection Act: What Every Website Owner Must Do Before December 2026

/in ,

Nigeria’s data protection law has teeth. Since the Nigeria Data Protection Act (NDPA) came into force in 2023, the Nigeria Data Protection Commission (NDPC) has had the legal authority to investigate, fine, and publicly name organisations that mishandle personal data. Most Nigerian website owners do not know they are covered. They are.

Who the NDPA Applies To

The NDPA applies to any organisation — public or private — that collects, processes, or stores personal data of Nigerian residents. If your website has a contact form, you are a data controller under the NDPA.

  • E-commerce sites collecting billing and delivery information
  • Blogs with contact forms or comment sections
  • Corporate websites with careers pages
  • Any app that handles user accounts

What the Law Requires

  1. A Privacy Policy. Clear, accessible, written in plain language — explaining what data is collected, how it is used, stored, and shared.
  2. A Legal Basis for Processing. Justify why you collect each piece of data: consent, contractual necessity, legal obligation, or legitimate interest.
  3. Data Subject Rights. Nigerian residents have the right to access, correct, delete, and object to processing of their data.
  4. Breach Notification. Notify the NDPC within 72 hours of a breach. Affected users must also be informed.
  5. Data Security Measures. HTTPS encryption, access controls, and secure storage. Read: Don’t Let Bad Hosting Sink Your Website (dst.com.ng).

NDPC Enforcement Powers

  • Issue compliance orders
  • Impose fines up to 2% of annual gross revenue or NGN 10 million (whichever is higher)
  • Publish names of non-compliant organisations
  • Refer criminal violations to prosecutorial authorities

What Website Owners Should Do Now

  1. Audit your data flows — map every point where personal data is collected.
  2. Update or create your privacy policy using NDPC guidance at ndpc.gov.ng.
  3. Review your plugins for data handling compliance. Read: Key Aspects of Code Obfuscation.
  4. Implement a cookie consent mechanism that allows users to accept or refuse before cookies are set.
  5. Have an incident response plan — the 72-hour NDPC notification window is tight.