For compliance with the Nigeria Data Protection Act (NDPA) 2023, organizations must implement a comprehensive set of documents and policies to regulate personal data processing. The mandatory requirements vary based on the nature and scale of an organization’s data activities.
Mandatory documents and records
Regardless of your size, all organizations handling personal data are required to create and maintain specific documents.
- Privacy policy: A clear, accessible policy must be provided to data subjects before collecting their data. It must detail the data controller’s identity, the lawful basis and purpose for processing, recipients of data, retention periods, and data subjects’ rights.
- Consent records: Organizations must be able to prove they have obtained valid consent where it is the lawful basis for processing personal data. This consent must be freely given, specific, and unambiguous, with clear records of when and how it was obtained.
- Data Processing Agreements (DPAs): Written contracts are mandatory when engaging a third-party data processor. The DPA must outline the roles and obligations of both parties, ensuring the processor complies with the NDPA.
- Data breach records: A register of data breaches must be maintained, detailing the incident, its cause, and the remedial actions taken. Serious breaches that pose a high risk to individuals must be reported to the Nigeria Data Protection Commission (NDPC) within 72 hours of discovery.
- Record of Processing Activities (RoPA): You must maintain a RoPA that contains a detailed description of all data processing operations, including the types of data, purposes, and recipients. A Data Protection Officer (DPO) must also provide semi-annual data protection reports to management, which become part of the RoPA.
Mandatory policies and procedures
To implement the principles of the NDPA, organizations must establish and follow specific internal policies.
- Information Security Policy: Outlines the technical and organizational measures used to protect personal data from unauthorized access, loss, or theft. For significant controllers and processors, this must be particularly robust.
- Data Retention Policy: Specifies how long different types of personal data will be kept before being securely deleted or anonymized.
- Incident Management Policy: Details the process for handling and responding to data security incidents, including a data breach response plan.
- Data Protection Impact Assessment (DPIA) Policy: Defines the process for conducting DPIAs for any processing activity that poses a high risk to the rights and freedoms of data subjects. If a high risk remains after mitigation, the NDPC must be consulted.
- Handling of Data Subject Requests: Establishes clear procedures for how individuals can exercise their rights, including the right to access, rectify, or erase their data.
Requirements for organizations of major importance
Organizations classified as “Data Controllers and Data Processors of Major Importance” (DCPMIs) have additional, mandatory obligations, including:
- Appointment of a Data Protection Officer (DPO): A qualified individual must be designated to oversee data protection compliance. DCPMIs must register the DPO’s details with the NDPC.
- Annual Data Protection Compliance Audit Returns (CARs): DCPMIs are required to submit an annual audit return to the NDPC, often through a licensed Data Protection Compliance Organization (DPCO).
- Registration with the NDPC: These organizations must register with the NDPC and pay the applicable fees.
