Nigeria, data protection for schools is governed by the Nigeria Data Protection Act (NDPA) of 2023. All schools, whether public or private, that handle the personal data of students, parents, and staff are obligated to comply with the NDPA. Severe consequences, including substantial financial penalties and legal action, can result from non-compliance.
Which schools must comply with the NDPA?
The NDPA applies broadly to all organizations, including educational institutions, that process the personal data of data subjects in Nigeria. A school qualifies as a “Data Controller” under the Act.
Schools that fall under the category of Data Controllers of Major Importance face a stricter set of obligations, including mandatory registration with the Nigeria Data Protection Commission (NDPC) and the appointment of a Data Protection Officer (DPO).
- A school is considered a Data Controller of Major Importance if it:
- Processes the personal data of more than 200 data subjects within six months.
- Processes sensitive personal data, such as health information, on a large scale.
- Operates in the education sector, which is classified as a critical sector by the NDPC.
Consequences of non-compliance under the NDPA
Financial penalties
The NDPA imposes different penalty tiers based on an organization’s size and revenue.
- For schools not deemed of major importance: A fine of up to ₦2 million or 2% of the school’s annual gross revenue, whichever is higher.
- For schools designated as Data Controllers of Major Importance: A fine of up to ₦10 million or 2% of the school’s annual gross revenue, whichever is higher.
- NDPC enforcement powers: The NDPC can also issue binding compliance and enforcement orders, and failure to comply can lead to additional sanctions, including suspension of processing activities.
Legal liability
Non-compliance exposes schools to both regulatory and civil legal actions.
- Regulatory investigations: The NDPC has strong investigatory and enforcement powers. It can audit a school’s compliance and compel it to take specific actions.
- Civil lawsuits: Data subjects whose personal data has been misused or compromised can sue the school for compensation. Section 51 of the NDPA provides this right to individuals.
- Vicarious liability: The school can be held legally responsible for the data protection violations committed by its employees or agents.
Reputational damage
The impact of a data breach or privacy violation can significantly damage a school’s standing in the community.
- Loss of trust: A school’s reputation is built on trust. A data breach involving student data can erode the trust of parents, students, and the community, potentially leading to a loss of enrollment.
- Public listing: The NDPC has the power to publicly list the names of non-compliant organizations on its website, creating lasting public harm.
Impact on students and staff
The most severe consequences often affect the very people the school is meant to protect.
- Personal risk to students: The misuse of sensitive student information, including biometrics, photos, and health records, can lead to identity theft, fraud, bullying, and psychological distress.
- Operational disruption: Handling a data breach and a subsequent regulatory investigation can divert significant resources, disrupt school operations, and interfere with the core mission of education.
- Risk to staff: Staff members who handle student data can also be at risk of personal data compromise.
