The Nigeria Data Protection Act 2023 and the underlying NDPR framework have raised the bar for any business that processes personal data of Nigerians. Fines for non-compliance run up to 2% of annual gross revenue, and the Nigeria Data Protection Commission has been increasingly active about enforcement.
This is a practical, prioritised checklist. Treat it as a sequence, not a menu. The early items are foundational; the later ones build on top.
1. Map your data
You cannot protect what you cannot find. Document every system that holds personal data: your CRM, your accounting tool, the spreadsheet your sales lead keeps on her laptop, your support inbox. For each one, record what is held, who has access, where it lives, and how long you keep it.
This single exercise typically reveals 30 to 60% more data exposure than the leadership team expected.
2. Appoint a Data Protection Officer (or compliance lead)
Larger organisations and any business processing data at scale must designate a DPO. Smaller businesses still need a named accountable person. This is not a part-time afterthought role. They own the response when something goes wrong.
3. Establish a lawful basis for every processing activity
For each category of data, you must be able to state the lawful basis. The most common are consent, contract, legitimate interest, and legal obligation. If you cannot point to one, you cannot lawfully hold that data.
4. Update your privacy notice
A compliant privacy notice tells people what you collect, why, how long you keep it, who you share it with, and what rights they have. Generic templates copied from other websites will not survive inspection. Write yours.
5. Build a process for data subject requests
Anyone whose data you hold can request access, correction, or deletion. You must respond within statutory timeframes. Decide today who handles these requests, where they get logged, and what your response template looks like. Test it.
6. Sign data processing agreements with every vendor
Any third party that touches your customer data, from your email service provider to your cloud accounting tool, needs a written data processing agreement. Their breach becomes your incident.
7. Lock down access controls
Apply least-privilege access. Finance does not need access to engineering systems. Sales does not need full HR records. Document who can see what, and review quarterly.
8. Encrypt data at rest and in transit
Disk encryption on all company laptops. TLS on every web service. Encrypted backups. None of this is exotic any more. If you are not doing it, fix that first.
9. Set up breach notification procedures
You have 72 hours to notify the NDPC of a personal data breach. Decide now: who declares an incident, who notifies the regulator, who notifies affected individuals, what gets logged. Practice the runbook. Discovering the process for the first time during a real breach is not a plan.
10. Conduct an annual data protection audit
NDPR-regulated businesses processing data above certain thresholds must file an annual audit. Even those below threshold should run an internal review. Audits surface the controls that quietly stopped working over the year, before the regulator does it for you.
None of this needs to be done in a quarter. A realistic timeline for a 20 to 100 person business is six to nine months from a standing start to comfortably compliant. Start with data mapping today.