Privacy Policy for a Nigerian Business
If your website, app or shop collects a name, an email address, a phone number or a payment detail, you are processing personal data, and Nigerian law now has something to say about it.
The Nigeria Data Protection Act 2023 replaced the older 2019 Regulation and set up the Nigeria Data Protection Commission to enforce it. A privacy policy is the document that tells people what you collect, why, and what rights they have over it. It is also the first thing a regulator asks for.
What the Data Protection Act Actually Requires
The Act works on a simple idea. You may only process somebody's personal data if you have a lawful basis for doing so, and you must tell them about it in clear language before or at the point you collect it.
The lawful bases include consent, performance of a contract, compliance with a legal obligation, protection of vital interests, a public interest task, and legitimate interests. Most businesses rely on contract and legitimate interests far more than on consent, and that is fine. What is not fine is claiming consent you never properly obtained.
The Act also requires that data be collected for a specified purpose, kept no longer than necessary, kept accurate, and kept secure. Your policy should show that you have thought about each of those.
What Goes In the Policy
Who you are. Your registered business name, your registration number at the Corporate Affairs Commission, your address, and a contact address for privacy questions.
What you collect. Be specific. Names, emails, phone numbers, delivery addresses, payment references, device and browser information, location if you take it.
Why you collect it. Purpose by purpose, not one vague paragraph.
Your lawful basis for each purpose. This is the part most policies skip, and it is the part the Act is built around.
Who you share it with. Named categories: payment processors, delivery partners, hosting providers, analytics providers, and anybody you are legally required to disclose to.
Whether it leaves Nigeria. If your hosting, email or analytics sit abroad, and for most Nigerian businesses they do, say so and say what protects the transfer.
How long you keep it. Give periods, or the rule you use to work them out.
The rights people have. Set out below.
How to complain. To you first, then to the Nigeria Data Protection Commission.
The Rights You Have to Honour
Under the Act a person whose data you hold can ask to see it, ask you to correct it, ask you to delete it, ask you to stop processing it, object to processing based on legitimate interests or direct marketing, withdraw consent where consent was the basis, and ask for their data in a portable form.
Your policy should say how somebody exercises these rights and how quickly you will respond. Saying it is easy. Being able to do it when a request arrives is the harder part, and worth working out before you publish the promise.
Cross Border Transfers
Almost every Nigerian business sends data abroad without thinking about it. Your website is on a foreign host. Your email is Gmail or Microsoft. Your analytics are Google. Your payments run through a processor with foreign infrastructure.
The Act permits transfers outside Nigeria where the destination provides an adequate level of protection, or where one of the other conditions applies, such as the data subject's consent or the necessity of the transfer for a contract. Your policy should name that you transfer, say roughly where, and say what you rely on. Pretending it does not happen is worse than explaining it.
Breaches, and the Clock That Starts
If personal data you hold is exposed, lost or stolen, the Act requires you to report it to the Nigeria Data Protection Commission, and in serious cases to tell the people affected. There are time limits, and they are short.
Your policy does not need to set out your whole incident plan, but it should say that you have one and that you will notify people where the law requires it. More importantly, have the plan. A breach discovered on a Friday evening is not the moment to work out who to call.
Where Businesses Get This Wrong
Copying a foreign policy. A policy naming the GDPR and a European supervisory authority, for a Lagos business with Nigerian customers, tells a regulator you did not read either law.
Claiming consent for everything. Consent must be freely given and specific. A pre-ticked box or a line in your terms is not consent.
Promising things you cannot do. If you say you will delete data within thirty days of a request, you need to be able to find and delete it.
Publishing it and forgetting it. Add a new analytics tool or a new delivery partner and the policy is out of date the same day.
Frequently Asked Questions About Nigerian Privacy Policies
Is a privacy policy legally required in Nigeria? If you process personal data, the Nigeria Data Protection Act 2023 requires you to give people clear information about that processing, and a published privacy policy is how businesses do it. So in practice, yes.
Does the NDPA apply to a small business? The Act applies to processing of personal data in Nigeria regardless of size. Some extra duties, such as appointing a data protection officer and filing an audit, attach mainly to larger controllers and those handling data at scale, but the core obligations apply to everyone.
Can I just use a GDPR policy? No. The structures are similar but the law, the regulator and the terminology are different. A policy citing European law for a Nigerian business looks like it was never read, and it will not answer the questions the Nigeria Data Protection Commission asks.
Do I need to register with the Nigeria Data Protection Commission? Controllers and processors of major importance are required to register with the Commission. Whether you fall into that category depends on the volume and nature of the data you handle, so it is worth checking rather than assuming.
What happens if I get it wrong? The Commission can investigate, issue orders and impose penalties, and the size of a penalty can be calculated against turnover for larger controllers. Beyond that, a badly handled breach costs you customers faster than it costs you a fine.
Getting Your Privacy Policy Right
Read next: why even an Instagram shop needs a privacy policy. Your site will also want a cookie policy and terms and conditions.
A good privacy policy is specific to what your business actually does with data, written in language a customer can follow, and grounded in Nigerian law rather than borrowed from somewhere else.
Answer a few questions about what you collect and why, and you will have a privacy policy built for the Nigeria Data Protection Act 2023, ready to download in Word and PDF.