Appointing a Data Protection Officer in Nigeria
Which Nigerian businesses must designate a Data Protection Officer under the GAID 2025, what they must publish and report, and how to set the role up.
By Achekam · · 4 min read · For Running a business businesses in Nigeria
Ask a room of Nigerian business owners who their Data Protection Officer is and you will get some blank looks, a few names of IT staff, and one person who says "our lawyer, I think". The role sounds like something only banks and telecoms companies need. Under the Nigeria Data Protection Commission's rules, it reaches much further than that.
This article explains which businesses must designate a Data Protection Officer (DPO), what they must publish and tell the Nigeria Data Protection Commission (NDPC), what the DPO reports and to whom, and how to give that person what they need to do the job.
Who must designate a DPO
Under the NDPC's General Application and Implementation Directive (GAID) 2025, a data controller or data processor of major importance must designate a Data Protection Officer. Everything turns on that phrase.
The NDPC's Guidance Notice on registration, dated 19 December 2024 and reproduced as a schedule to the GAID, designates a controller or processor as of major importance if any of these applies:
- it keeps or has access to a filing system for personal data and processes the personal data of more than 200 data subjects in six months;
- it provides commercial ICT services on other people's devices; or
- it processes personal data in listed sectors such as financial, health, education, hospitality, insurance, oil and gas and e-commerce.
The first test catches a great many ordinary businesses. A private school with a few hundred pupils' records, a clinic, a hotel's guest register, an online shop with a customer list: each can pass the 200-person mark in six months without trying. The Guidance Notice sets out these tests and the registration requirements in the NDPC's notice on registering data controllers and processors of major importance. (Its heading cites the "Nigeria Data Protection Act, 2003", a misprint for 2023.)
Publishing the contact details and telling the NDPC
Designating someone is not enough on its own. Under the GAID, the controller or processor must also publish the DPO's contact details and communicate them to the NDPC in the prescribed form.
In practice, "publish" means somewhere the public will find it: your privacy notice, your website's contact page, the bottom of customer forms. Use a role address, such as a dedicated e-mail box, rather than a personal one, so the contact survives a change of person. When the DPO changes, update the published details and tell the NDPC. The GAID also requires notice to the NDPC of any significant change to registration information within sixty days.
Reporting to management, twice a year
The GAID says the DPO reports directly to management. That line matters: a DPO buried three levels down in the IT department, who needs permission to raise a concern, is not what the directive describes.
The GAID also requires a semi-annual data protection report, compiled by the DPO and submitted to management. A useful report covers what personal data the business holds and why, any incidents and how they were handled, requests from individuals, changes in systems or suppliers that affect personal data, and what the DPO recommends. Keep each report with the board or management minutes that received it.
Registration and annual filings depend on the business's tier. Under the GAID, ultra-high and extra-high level controllers and processors register once and file compliance audit returns annually, while ordinary-high level ones renew their registration every year and need not file an annual return when they renew. The tiers are explained in NDPC registration tiers.
Controllers, processors and the principles the DPO watches
The DPO's daily work is making sure processing follows the data protection principles. The NDPC states that under section 29 of the Nigeria Data Protection Act a data controller, the organisation that decides the purpose and manner of processing, must ensure that the methods by which data is collected are strictly in line with the principles of data protection. It also states that a data processor must ensure that processing on behalf of the controller follows the governing principles of data processing.
Most businesses are both. A business is the controller of its own customers' and employees' data, and its payroll bureau, cloud software and courier are processors for it. A DPO should know which is which for every significant flow of personal data, and check that processors have agreed in writing to follow the principles.
Giving the DPO the access they need
A DPO who cannot see how data is handled cannot report on it. If your business runs its books, payroll and documents in Achekam, the workspace's people and permissions settings help.
- Bring the DPO in as a member. A workspace administrator can invite colleagues by e-mailed link, give each a role, and suspend, reactivate or remove them. An outside DPO can be invited the same way and removed when the engagement ends.
- Shape the role. The workspace can allow or deny what each role may do, and check why a member may or may not act. A DPO usually needs to see who has access to what, not to post journals or approve pay runs, so build a role that gives oversight without operating rights.
- Review access regularly. The DPO's semi-annual report is a good moment to list every member, their role, and whether they still need it.
Internal or external?
Some businesses name a senior employee; others engage an outside adviser. Whichever you choose, test the arrangement against what the GAID asks of the role: a published contact, a direct line to management, a report every six months and someone who can lead the response when something goes wrong. If the person cannot do all four, the arrangement needs to change.
Write the designation down in a management resolution, publish the contact, file it with the NDPC and diarise the first report. And make sure the DPO knows the breach rules before they are needed; see reporting a personal data breach.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
