Privacy Policy

A usable Nigerian privacy policy answers a fixed set of questions.

Who you are, with a real business name and contact details. What personal data you collect, described specifically rather than as information about you. Why you collect each category. The lawful basis for each use. Who you share it with, including payment processors, delivery partners, analytics providers and cloud hosts. Whether it leaves Nigeria and on what basis. How long you keep it. What rights the person has and how to exercise them. How to complain, including to the Nigeria Data Protection Commission. When the policy was last updated.

Where to put it depends on where you actually collect data. On a website, link it in the footer and at every point of collection. On a mobile app, in the store listing and in the app. For an Instagram or WhatsApp business, a link in the bio to a page holding the policy works, and is far better than nothing.

The part businesses skip is the last one: doing what it says. A policy promising deletion on request, from a business with no way to delete anything, is worse than no policy at all.

The most common Nigerian misconception is that this applies only to big technology companies.

It does not. A business taking a customer's name, phone number and delivery address is processing personal data. That includes the Instagram shop, the food vendor taking orders on WhatsApp, the school collecting parent details, the gym with a membership register and the estate agent with a list of enquiries.

Payment processors are the other point people miss. Where a Nigerian business uses a payment gateway, the gateway is processing customer data, and the privacy policy should say so and name the categories shared.

A further practical point: copying a foreign privacy policy is a common shortcut and a poor one. Policies drafted for other jurisdictions reference the wrong regulator, the wrong legislation and rights framed under a different law, which is obvious to anybody who reads it and unhelpful if the Commission ever asks.

The Commission has published guidance and has been active, so having a policy that matches the Act and matches what you actually do is worth the afternoon it takes.

Three documents that live in the same website footer and do different jobs.

A privacy policy explains how you handle personal data. It is required by data protection law, it is a notice rather than an agreement, and you need it even if your site sells nothing.

Terms and conditions form the contract between you and the user. What the service is, what it costs, what each side may and may not do, limits on liability, and how disputes are resolved. They bind because the user accepts them.

A cookie policy explains the small files your site places on visitors' devices, what each does and how to control them. It is often folded into the privacy policy, though a separate one is clearer where the site uses analytics and advertising tools.

Most Nigerian websites need at least the first two. A site with analytics or advertising needs the third.

A policy is a notice, not a shield. Publishing one does not make unlawful processing lawful, and a business that collects more than it needs is not protected by having disclosed that it does.

It also has to match reality. A policy describing security measures the business does not have is evidence against it rather than for it.

Generic templates go stale. Adding a new payment processor, a new analytics tool or a new marketing channel changes what the policy should say, and almost nobody updates it.

And a policy nobody can find achieves nothing. Transparency means the information is actually available at the point of collection, not buried three clicks away.