What NDPR means for your website and customer data

Nigeria's data protection rules apply to any business that collects names, emails or phone numbers. In practice, publish a clear privacy policy, get consent before marketing emails or WhatsApp messages, secure data with encryption, access controls and backups, collect only what you need, and have a plan for responding to a data breach.

The main law is now the Nigeria Data Protection Act 2023, which replaced most of the Nigeria Data Protection Regulation (NDPR) of 2019, though many people still call the rules NDPR. The Nigeria Data Protection Commission (NDPC) enforces them. Its General Application and Implementation Directive (GAID), in force since September 2025, explains how to comply in practice.

Who does the law apply to?

The rules apply to any organisation that collects or uses the personal data of people in Nigeria, whatever its size. Personal data is anything that identifies a person, such as a name, phone number, email address, photo, location or account number. A website contact form, a WhatsApp customer list and a staff payroll file all count.

Organisations that handle large amounts of personal data, or work in sectors such as banking, telecoms, health and insurance, can be classed as data controllers or processors of major importance. They must register with the NDPC, appoint a data protection officer and file regular compliance audit returns. Check the NDPC's current criteria to see whether this applies to you.

What does the law require?

The Act asks you to follow a set of principles whenever you handle personal data.

1. Have a lawful basis, such as consent, a contract with the person, a legal duty, or a legitimate interest that does not override their rights.
2. Be transparent. Tell people what you collect, why, how long you keep it and who you share it with.
3. Collect only what you need for the stated purpose, and keep it accurate.
4. Keep it only as long as needed. Delete or anonymise data when the purpose ends.
5. Keep it secure against loss, theft and unauthorised access.

Practical steps for your website

1. Publish a clear privacy policy explaining what you collect, why, how long you keep it, who you share it with and how people can contact you. Link to it from every form and from the footer.
2. Get consent before marketing emails or WhatsApp messages, using a box that is not ticked in advance, and make unsubscribing easy.
3. Ask before tracking. Analytics and advertising cookies that follow visitors need a cookie notice that lets people say no.
4. Secure your data with HTTPS, strong passwords, two-factor authentication, access limited to staff who need it, and backups.
5. Collect only what you need on forms. If you do not use a date of birth, do not ask for one.
6. Check your suppliers. Your hosting, email and CRM providers handle data for you. Use providers with clear security terms, and know where they store data.
7. Have a breach plan so you can respond and notify quickly.

Your customers' rights

People can ask to see the data you hold about them, correct it, delete it, move it to another provider and object to marketing. Decide who handles these requests and answer them promptly. A dedicated email address and a short checklist are enough for most small businesses.

If there is a data breach

If personal data is lost, stolen or exposed and the breach is likely to put people at risk, the Act requires you to notify the NDPC within 72 hours of finding out. Where the risk is high, you must also tell the people affected, in plain language, with steps they can take to protect themselves. Keep a record of every breach, even small ones.

What happens if you do not comply?

The NDPC can investigate complaints, order changes and impose fines. Under the Act, fines for organisations of major importance can reach ₦10 million or 2% of annual gross revenue, whichever is higher, and ₦2 million or 2% for others. The NDPC has taken enforcement action in several sectors since 2025, and a breach usually costs more in lost customer trust than in fines.

Our security team helps Nigerian businesses review their websites and data handling, write privacy policies and set up the safeguards the law expects.