Running a small business in Lagos usually means handling lots of people’s information. You might not even think much about it. The Nigeria Data Protection Act makes handling that information a legal responsibility. You may have customers’ names and phone numbers sitting in an Excel sheet. HR could hold employees’ CVs, home addresses, bank details and next-of-kin information. Meanwhile, marketing has another list filled with email addresses.

It all feels like normal business stuff.

But collecting, storing or using people’s personal information comes with a responsibility. Your business must handle it properly and protect it.

That is where the Nigeria Data Protection Act 2023 comes in. It sets the rules around how businesses collect, use, store and protect personal information.

What does the Nigeria Data Protection Act cover?

Nigeria’s Data Protection Act became law in 2023. It established the Nigeria Data Protection Commission as the country’s data protection regulator. The law governs how organisations collect, use, store, share and otherwise process personal data.

And “personal data” is much broader than passwords or bank details.

Think about what an ordinary company may already have: customer names and phone numbers, employee records, email addresses, photographs, identification information and other information connected to identifiable people.

Suddenly, this stops looking like something only banks and technology companies need to worry about.

Your ordinary customer database counts too.

The basic idea is actually pretty reasonable

Say you give a furniture company your phone number because they need to deliver a sofa to your house. You expect them to call or message you about the delivery. That makes sense.

What you probably would not expect is for other businesses to suddenly have that number. Then random WhatsApp adverts start showing up on your phone.

And that simple example gets to the heart of data protection. Someone may give a business their personal information for a particular reason. That does not give the business permission to use it however it wants.

Under Nigeria’s data protection framework, people have rights over their personal information. They can ask how a business uses their information, request access and correct mistakes. They can also object to certain uses or restrict processing. In some situations, they can ask the business to delete or transfer their data. The point is simple: receiving someone’s information does not make it yours to use however you like.

Why HR Needs to Take Data Protection Seriously!

HR teams really need to pay attention to this part, because data protection is not just about customers.

The rules can also apply to employees, job applicants, visitors, guests and basically anyone whose personal information ends up in the company’s hands.

And when you look at what HR actually keeps, that is a lot of information. CVs, home addresses, phone numbers, salary details, bank accounts, ID documents, emergency contacts and performance records can all be sitting in one employee file.

In many companies, HR is holding some of the most sensitive information in the entire business.

So an employee folder that almost anyone can open is not good enough. Calling the information “internal” does not change that. Internal data still needs proper protection and proper access controls.

Nigeria Data Protection Act: registration and audits

The Act also recognises Data Controllers and Processors of Major Importance, often shortened to DCPMI.

Depending on the organisation and its processing activities, registration with the NDPC and additional compliance requirements can apply. The Commission maintains registration services and an official list of organisations recognised in this category.

There is another important compliance piece: Compliance Audit Returns, or CAR.

Under the NDPC’s implementation framework, organisations of major importance can have annual compliance-audit filing obligations. The Commission’s guidance says organisations submit CAR filings through a licensed Data Protection Compliance Organisation, or DPCO.

This isn’t something to leave until somebody from compliance suddenly remembers it on a Friday afternoon.

“But we’re a small company…”

Being small doesn’t automatically make privacy disappear.

Your obligations depend on what you’re doing with personal data, the nature and scale of the processing, and the applicable regulatory classification.

A ten-person company handling substantial or sensitive customer information can still have meaningful privacy responsibilities.

And here’s another mistake worth avoiding: assuming another industry regulator replaces the Data Protection Act.

The NDPC explicitly says organisations still need to comply with the NDP Act even where their sector regulator has its own data-protection rules.

What can happen if a business gets this wrong?

This is the part where things get a little more serious. If a business gets data protection wrong, the consequences can go beyond a simple warning. The NDPC can require the organisation to correct the problem, compensate people who were affected, account for profits linked to the violation or pay a remedial fee.

For a controller or processor of major importance, that fee can be as high as the greater of ₦10 million or 2% of the organisation’s annual gross revenue from the previous financial year. For organisations outside that category, the maximum can be the greater of ₦2 million or 2% of annual gross revenue.

But the financial penalty may not even be the part that hurts the most.

Imagine telling thousands of customers that your business exposed their personal information. You failed to protect it properly.

That kind of message can damage trust very quickly. Once customers lose that trust, winning it back can be much harder than paying a fine.

How to put the Nigeria Data Protection Act into practice

Don’t begin by buying some expensive cybersecurity software and declaring the problem solved.

Start with something much simpler: find out what personal data you actually have.

Ask yourself a few practical questions:

• Where do you store customer information?
• Who can access employee records?
• Why do you collect each piece of information?
• How long do you keep it?
• Which vendors receive it?
• How do you handle requests to correct or delete information?

Then review access controls, privacy notices, staff training, vendor arrangements, retention practices and breach procedures. Also check whether your organisation has registration, audit, DPO or other regulatory obligations.

The NDPC’s current compliance framework puts real emphasis on organisational accountability, audits, Data Protection Officers, risk management and appropriate technical and organisational safeguards.

The interesting thing is that this doesn’t have to be viewed purely as paperwork.

Good data protection basically asks a company to answer one question: If somebody trusted us with their information, are we treating that trust responsibly?

That’s a pretty sensible question for any business.

And tomorrow morning, when someone casually says, “Just send me the customer spreadsheet,” you might look at that spreadsheet a little differently.

For more practical guidance on your business responsibilities, explore our compliance guides.