Answering a customer's data request under the NDPA
What a Nigerian business should do when a customer or lead asks to see, correct or delete their personal data, and which records in Achekam help.
By Achekam · · 4 min read · For Running a business businesses in Nigeria
The e-mail is polite but firm. A former customer wants to know what information your business holds about them, where you got it, and who you have shared it with. A week later a prospect you contacted asks you to delete their details and stop sending newsletters. Another customer says the address on their statements has been wrong for months and wants it fixed.
Under Nigeria's data protection law, each of these is a request you must take seriously and answer properly. This article explains the rights behind them, how to find what you hold, how to respond, and where Achekam's records help and where they set limits.
The rights behind the request
The Nigeria Data Protection Commission (NDPC) states that sections 34 to 38 of the Nigeria Data Protection Act give data subjects these rights:
- to be informed;
- to access their data;
- to rectification;
- to object to processing;
- to report to the supervisory authority;
- to restrict processing;
- to data portability;
- to be forgotten; and
- not to be subjected to automated decision-making.
The NDPC says the Act applies to an organisation domiciled, resident or operating in Nigeria, to processing of personal data within Nigeria, and to an organisation outside Nigeria that processes the personal data of someone in Nigeria. For a business trading in Nigeria, the starting assumption should be that these rights apply to its customers, leads and staff. The NDPC sets out the Act, its guidance and its registration rules on its website. Whether the Act reaches your business specifically is covered in does the NDPA apply to you.
Finding what you hold
An access request is only as good as your search. Personal data about one customer can sit in several places at once:
- Sales and accounts: invoices, statements, receipts and the customer's account.
- The CRM: lead records, notes on calls, campaign history.
- Documents: contracts, signed forms, ID copies, correspondence.
- E-mail and phones: messages staff exchanged with the person.
If your business uses Achekam, its Document Centre is a folder-based store where files and whole folders can be uploaded, tagged, searched and archived, and a new version keeps the earlier ones. Searching it by the person's name or customer number is one step; search the CRM and the sales records too, then the mailboxes and devices outside Achekam.
Write down where you searched. If the person later complains to the NDPC, a record of a careful search is your best evidence of good faith.
Correcting records
A request for rectification is usually the easiest to meet and the most embarrassing to ignore. Correct the record at its source, check whether the wrong detail was copied elsewhere, such as onto open invoices or a mailing list, and tell the person what you changed.
Under section 29 of the Act, as the NDPC describes it, a data controller must ensure that the methods by which data is collected are strictly in line with the principles of data protection. A rectification request is often a sign that a collection method is producing errors. If the same mistake keeps appearing, fix the form or process that creates it.
Deletion, closed leads and newsletters
Requests to delete or to stop marketing need the most care, because your systems may not do exactly what the person asks.
Leads in Achekam's CRM. A lead that someone has worked cannot be deleted; it is closed as lost instead. The server lets an administrator delete a lead only while it is still new, has not become a client and has no proposal. So for most leads, the honest answer to a deletion request is that the record is closed and kept, not erased. Tell the person what you keep and why, and do not use the closed record for marketing.
Newsletters. A workspace can keep a mailing list and send campaigns with an unsubscribe link in every letter. Be aware that in Achekam a lead marked "Not interested" is added to the mailing list automatically. A person who has objected to marketing must not receive the next campaign, so when you mark such a lead, make sure their objection is honoured before anything else goes out.
Accounting records. The NRS expects books of account to be kept for at least six years after the relevant assessment year, so a "forget me" request rarely means deleting the books. Explain what you must keep, for how long, and that it will be used for nothing else.
What can go wrong
The NDPC says a data controller or processor found in breach of a data subject's privacy rights may be ordered under section 48(2) of the Act to remedy the violation, pay compensation to the data subject, account for the profits realised from the violation, or pay a remedial fee. Data subjects may also bring civil actions in court.
A request handled late, incompletely or dismissively is exactly how a dissatisfied customer becomes a complaint. If a request reveals that data was exposed, the breach rules apply too; see reporting a personal data breach.
A request log and response template
Keep one log for every request, with:
- date received and how;
- who the person is, and how you confirmed their identity;
- which right they are using;
- where you searched;
- what you found, changed, restricted or kept, and why;
- date of your reply and who sent it.
And a short reply template that covers: what you hold and where it came from; what you have done; what you must keep and why; and how they can contact you again or report to the NDPC. Answer in plain language. Most people asking about their data want to know you take it seriously, and a clear, complete reply shows that you do.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
