Manage data protection (NDPA)
Meet Nigeria's data protection rules and handle data requests.
Open NDPA Compliance
Go to NDPA Compliance from the sidebar. The Nigeria Data Protection Act 2023 (NDPA) applies to any organisation that collects or processes personal data of Nigerian residents — including employee records, customer contact lists, and website analytics.
Register with NDPC (if required)
Data controllers processing the personal data of 2,000 or more data subjects per year must register with the Nigeria Data Protection Commission (NDPC). Tap Check Registration Status — if you're liable, tap Start NDPC Registration and follow the steps to file the registration form.
Build your data inventory
Tap Add Data Inventory to map every category of personal data you hold. For each entry, record: what data it is (e.g. 'customer names and phone numbers'), why you hold it (e.g. 'order fulfilment'), where it's stored (e.g. 'platform database'), how long you keep it, and who has access.
Document your lawful basis
For each data category, select the Lawful Basis under which you process it: Consent, Contract, Legal Obligation, Vital Interest, Public Task, or Legitimate Interest. Processing personal data without a lawful basis is a violation.
Appoint a Data Protection Officer (if required)
If you process sensitive data (health, financial, biometric) or data of more than 10,000 people, you must appoint a DPO. In the DPO section, enter their name and contact details. The DPO can be an employee or an external consultant.
Handle a data subject request (DSR)
If a customer or employee asks to access, correct, or delete their data (a Data Subject Request), tap New DSR in the DSR tab. Log their name, request type, and the date received. You must respond within 30 days. Use the platform's response templates to reply formally.
Report a data breach
If personal data is exposed (e.g. a database breach, a misdirected email), tap Report Breach immediately. You must notify the NDPC within 72 hours of discovering the breach. Enter what happened, what data was affected, and what steps you've taken. The platform drafts the NDPC notification letter.
Generate your annual NDPA report
Once a year, NDPC-registered organisations must submit a Data Protection Compliance Report. Tap Generate NDPA Report. The system compiles your data inventory, DSR log, breach log, and DPO details into the NDPC's required format. Review it, then submit through the NDPC portal and record the submission date here.