NDPA and NDPR Compliance Checklist for Financial Sector
- Data Protection Officer (DPO) Appointment
- Designate a qualified DPO responsible for data protection compliance.
- Ensure DPO contact details are publicly available.
- Data Inventory and Mapping
- Conduct a comprehensive data audit to identify personal data processed.
- Document data flows within and outside the organization.
- Legal Basis for Processing
- Establish clear lawful grounds for processing personal data (e.g., consent, contract).
- Maintain records of consent where applicable.
- Privacy Policy and Notices
- Develop and publish a clear privacy policy outlining data handling practices.
- Ensure privacy notices are provided at data collection points.
- Data Subject Rights
- Implement procedures to facilitate rights such as access, correction, deletion, and objection.
- Respond to data subject requests within stipulated timelines.
- Data Security Measures
- Adopt appropriate technical and organizational security measures (encryption, access controls).
- Regularly review and update security protocols.
- Data Breach Management
- Establish a data breach response plan.
- Notify the NDPR and affected data subjects within 72 hours of breach discovery.
- Data Processing Agreements
- Ensure contracts with third-party processors include NDPR-compliant data protection clauses.
- Training and Awareness
- Conduct regular staff training on data protection principles and NDPR requirements.
- Data Transfer Controls
- Implement safeguards for transfer of personal data outside Nigeria as per NDPR guidelines.
- Record Keeping and Documentation
- Maintain detailed records of processing activities and compliance measures.
- Compliance Monitoring and Audits
- Periodically audit data protection practices to ensure ongoing NDPR compliance.
Ensure adherence to these steps to meet NDPA and NDPR requirements within the financial sector.
