Does the Nigeria Data Protection Act apply to you?
Who the Nigeria Data Protection Act covers, why sector rules do not replace it, what the NDPC can impose, and first steps for a small Nigerian business.
By Achekam · · 4 min read · For Running a business businesses in Nigeria
Ask a small Nigerian business whether data protection law applies to it and the usual answer is "we're too small" or "that's for banks". Then look at what the business actually holds: customers' names and phone numbers in a WhatsApp group, staff salaries and bank details in a spreadsheet, a list of leads from last year's trade fair, ID copies taken when goods were bought on credit. All of it is personal data.
The Nigeria Data Protection Act, 2023 is written broadly, and the Nigeria Data Protection Commission (NDPC) reads it broadly. This article explains who it covers, why a sector's own rules do not take its place, what the NDPC can impose, and a sensible first set of steps for a business that has never thought about it.
Who the Act covers
The NDPC says the Act applies in three situations:
- To an organisation domiciled, resident or operating in Nigeria. A business trading in Nigeria is inside the Act, whatever its size.
- To processing of personal data within Nigeria. Collecting, storing, using or sharing personal data here brings the processing within the Act.
- To an organisation outside Nigeria that processes personal data of a data subject in Nigeria. A foreign supplier handling your Nigerian customers' data is covered too.
Size changes what the Act asks of you, not whether it applies. Larger organisations, and those in certain sectors, carry extra duties such as registration and annual audit returns; those are explained in NDPC registration tiers. The basic duties of handling personal data lawfully apply to everyone covered. The NDPC answers these questions on its frequently asked questions page, which also covers consent, cross-border transfers and compliance audit returns.
Sector rules do not replace it
Banks, telecoms companies, insurers and others often have data rules from their own regulators. The NDPC says an organisation must still comply with the Act where its sector regulator has issued a data protection regulation for the sector, because the Act covers all sectors and all aspects of data privacy.
So a microfinance bank that follows its regulator's guidance is not thereby done. It has two sets of rules to meet, and where they overlap, meeting both is the safe course.
The controller's duty to collect data properly
The core duty sits with whoever decides why and how personal data is processed. The NDPC states that under section 29 of the Act, a data controller, the organisation that determines the purpose and manner of processing, must ensure that the methods by which data is collected are strictly in line with the principles of data protection.
In practice that starts at the point of collection: the form on your website, the sign-up sheet at an event, the account-opening form at the counter. Ask for what you need, say why you need it, and do not reuse it for something the person would not expect.
What the NDPC can impose
The NDPC describes the penalties and remedial fees under section 48 of the Act in two bands:
| Organisation | Maximum penalty or remedial fee, per the NDPC |
|---|---|
| Data controller or processor of major importance | the greater of N10,000,000.00 and 2% of annual gross revenue in the preceding financial year |
| Any other data controller or processor | the greater of N2,000,000.00 and 2% of annual gross revenue in the preceding financial year |
The NDPC also says that a controller or processor found in breach of a data subject's privacy rights may be ordered under section 48(2) to remedy the violation, pay compensation to the data subject, account for the profits realised from the violation, or pay a remedial fee. Data subjects may also go to court.
For a small business, the fixed figure in the second band is the one to notice. The "greater of" wording means a business with modest revenue still faces the fixed amount as its ceiling.
Sign-in controls in Achekam
Most data protection failures in small businesses are not sophisticated attacks. They are shared passwords, former staff who can still log in, and outsiders with more access than they need. If your business keeps its books, payroll and customer records in Achekam, three controls address exactly those.
- Two-factor sign-in. Users can turn on two-factor sign-in with an authenticator app, and the workspace can require it for all members.
- Outsiders meet your rules. A member of an accounting firm opening your books must meet your business's own IP allowlist and two-factor rules, so your settings apply to your accountant's staff as well.
- Removing people. A workspace administrator can suspend, reactivate or remove members, so a departing employee's access ends the day they leave.
These controls are part of handling personal data responsibly. They do not, on their own, meet every duty under the Act, and nothing in software does that for you.
First steps for a small business
- List the personal data you hold: customers, staff, leads, suppliers' contacts, and where each list lives.
- Note why you hold each and whether you still need it.
- Check how you collect it: forms, sign-up sheets, phone calls. Say why you are asking.
- Tighten access: two-factor sign-in, no shared accounts, leavers removed promptly.
- Decide who answers questions from customers about their data, and how.
- Check whether you are of major importance and need to register.
- Write a short breach plan, so you know what to do if data is exposed; see reporting a personal data breach.
None of this needs a consultant to start. It needs someone in the business to own it.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
