NDPA Compliance Guide for Nigerian Software Teams in 2026

If your software collects names, phone numbers, BVNs, addresses, health records or payment details from Nigerians, you are handling personal data, and the law has clear expectations of you. The Nigeria Data Protection Act (NDPA) 2023 replaced the earlier reliance on the NDPR of 2019 as the primary data protection law, and the Nigeria Data Protection Commission (NDPC) now enforces it. At Tech Service Nigeria, we build and maintain systems for fintech firms, online stores, clinics and SaaS companies, and we have seen the same compliance gaps repeat across industries. This guide turns the legal language into engineering tasks your team can act on.

Why Data Privacy Compliance Matters for Nigerian Businesses

Compliance is not only about avoiding fines. Customers are increasingly cautious about who holds their information, and banks, payment partners and enterprise buyers now ask vendors for evidence of data protection practices during onboarding. Under the NDPA, organisations classified as data controllers or processors of major importance can face penalties of up to the higher of ₦10 million or 2% of annual gross revenue, while other organisations face lower but still significant maximums. A single breach handled badly can cost you both money and trust.

Who Does the NDPA Apply To?

The Act applies to any organisation that processes the personal data of individuals in Nigeria, even if the company is based elsewhere. It uses two key roles:

Data controller: the business that decides why and how personal data is processed, such as the retailer running an online shop.
Data processor: a party that processes data on the controller's behalf, such as a cloud host, a payroll vendor or a software agency like ours.

If you are a software company building for clients, you are usually a processor, and you need a written data processing agreement with each client. If you run your own product, you are the controller.

Step 1: Map the Personal Data You Actually Hold

You cannot protect what you cannot see. Start with a data inventory that records, for every system:

What personal data is collected (for example, name, email, national ID, location, device identifiers).
Why it is collected and which feature depends on it.
Where it is stored, including databases, backups, log files, analytics tools and spreadsheets shared by staff.
Who can access it and which third parties receive it, such as payment gateways, SMS providers and email platforms.
How long it is kept and when it is deleted.

A simple shared spreadsheet is enough to begin. The goal is to discover surprises, such as customer phone numbers sitting in old debug logs or full ID uploads stored in a public storage bucket.

Step 2: Establish a Lawful Basis and Collect Valid Consent

The NDPA allows processing only on a lawful basis: consent, performance of a contract, a legal obligation, protection of vital interests, a task in the public interest, or legitimate interest. Consent is the basis most software teams reach for, and it must be freely given, specific, informed and unambiguous. In practice this means:

No pre-ticked boxes and no bundling privacy consent inside general terms and conditions.
Plain-language explanations of what you collect and why, ideally in simple English with local language versions where your users need them.
Separate opt-ins for optional uses such as marketing messages.
An easy way to withdraw consent that is as simple as giving it.
A stored consent record with timestamp, version of the notice shown and the user identifier.

Do not use consent when another basis fits better. If you must collect a customer's address to deliver an order, the basis is contract performance, not consent.

Step 3: Build Data Subject Rights Into Your Product

Individuals have the right to access their data, correct it, request deletion, restrict or object to processing, and receive their data in a portable format. Design these as product features rather than manual email requests:

A profile page where users can view and edit their information.
An account deletion workflow that also removes or anonymises data in backups on a defined schedule and in downstream tools.
An export function that produces a structured file such as CSV or JSON.
A named contact, ideally a Data Protection Officer or privacy lead, with a dedicated email address and a response process.

Step 4: Apply Security Measures That Match the Risk

The Act requires appropriate technical and organisational safeguards. For most Nigerian SMEs and product teams, a solid baseline includes:

Encryption in transit with HTTPS and encryption at rest for databases and file storage.
Role-based access control and multi-factor authentication for admin accounts.
Masking or tokenising sensitive fields such as BVN and card data in logs and support dashboards.
Regular backups tested by restoring them, not just by taking them.
Prompt patching of servers, frameworks and dependencies.
Staff training on phishing and safe handling of customer information.

Step 5: Prepare a Breach Notification Process Before You Need It

When a breach is likely to put people's rights and freedoms at risk, the NDPA requires you to notify the NDPC within 72 hours of becoming aware of it. Where the risk to individuals is high, the affected people must be told without undue delay. A processor must inform the controller promptly. Teams that have never rehearsed this usually lose the first day arguing about who is in charge. Prepare the following in advance:

An incident response owner and a backup, with phone numbers that work outside office hours.
A short internal form that captures what happened, what data was affected, how many people are involved and what has been contained.
Pre-drafted notification templates for the regulator and for customers.
A breach register that records every incident, including those you decide not to report, along with your reasoning.

Step 6: Control Cross-Border Data Transfers

Many Nigerian products rely on cloud regions, email platforms and analytics tools hosted outside the country. The NDPA permits transfers abroad when the destination offers an adequate level of protection, or when you rely on safeguards such as binding corporate rules or contractual clauses, or on recognised conditions such as the individual's informed consent. Practically, you should:

List every vendor that receives personal data and the country where it is processed.
Review each vendor's data processing terms and security certifications.
Minimise what you send abroad, for example by removing identifiers before data goes to analytics tools.
Tell users in your privacy notice that their data may be transferred and why.

Step 7: Assess Risk, Register and Document

Carry out a Data Protection Impact Assessment (DPIA) before launching features that involve large-scale or sensitive data, such as credit scoring, biometric login or health records. Check whether your organisation qualifies as a data controller or processor of major importance, since that status brings registration with the NDPC, the appointment of a Data Protection Officer and the filing of annual compliance audit returns. The NDPC has also issued implementation guidance that clarifies these duties, so review it or ask a qualified data protection compliance organisation to confirm your obligations.

A Practical 30-Day Compliance Plan

Week 1: Appoint a privacy lead and complete the data inventory.
Week 2: Rewrite your privacy notice, fix consent screens and sign processing agreements with vendors.
Week 3: Implement access controls, log masking and the data subject request workflow.
Week 4: Run a breach simulation, document your findings and schedule a quarterly review.

Common Mistakes to Avoid

Copying a foreign privacy policy without checking it against Nigerian requirements.
Keeping data forever because storage is cheap.
Sharing customer lists over WhatsApp or personal email.
Giving every staff member and contractor full database access.
Assuming that hiring a software vendor transfers all legal responsibility away from you.

Conclusion

Meeting NDPA requirements is a matter of disciplined engineering and clear documentation, not a mystery. Map your data, collect consent honestly, build user rights into the product, secure what you hold and rehearse your breach response. Tech Service Nigeria helps businesses design privacy-conscious software, audit existing systems and put secure processes in place. This article is general guidance and not legal advice, so consult a qualified Nigerian data protection professional for your specific situation. When you are ready to make your product compliant by design, contact our team and we will help you start.