Our Blog

By Sandra Adeniran, Principal Partner

Your website’s privacy policy is a legally binding document, not just a formality. In Nigeria, the primary legislation governing data privacy is the Nigeria Data Protection Act (NDPA) 2023. A compliant privacy policy must clearly state what personal data you collect, the lawful basis for processing it, how long you store it, and the rights of your users regarding their data. For any Nigerian website collecting user information, from e-commerce sites like Jumia to blogs with newsletter sign-ups, a detailed and transparent policy is a mandatory legal requirement to avoid significant penalties.

This checklist details the essential privacy policy requirements for Nigerian websites. It is for any business owner, developer, or marketer operating a website that collects data from Nigerian citizens, ensuring you meet your obligations under the NDPA 2023.

Foundational Components

This first phase covers the absolute must-haves for your policy. These elements define what data you collect and why.

• Identify the Data Controller: State your company’s legal name and contact details. This is who is responsible for the data.
• Define Personal Information: List the specific types of personal information you collect (e.g., name, email address, phone number, IP address, location data).
• State the Lawful Basis: For each type of data collected, declare your legal reason for processing it. Under the NDPA, this isn’t limited to just consent. It can also be contractual necessity, legal obligation, vital interests, public interest, or legitimate interests.
• Explain Data Usage: Detail exactly how you use the collected information. This includes service delivery, marketing, analytics, and user account management.
• Cookie Policy: Disclose your use of cookies and other tracking technologies. Explain what they do and link to a more detailed cookie policy if necessary.

User Rights and Consent

This section focuses on the rights granted to individuals (data subjects) under the NDPA.

• Right to Access: Explain how users can request a copy of the personal data you hold about them.
• Right to Rectification: Detail the process for users to correct inaccurate or incomplete information.
• Right to Erasure (Right to be Forgotten): Describe how users can request the deletion of their personal data.
• Right to Restrict Processing: Inform users of their right to limit how you process their data.
• Right to Data Portability: Explain how users can obtain and reuse their data for their own purposes across different services.
• Obtain Explicit Consent: For data processing based on consent (like marketing emails), you must obtain clear, affirmative consent. Pre-ticked boxes are not valid.

Data Management and Security

This phase covers your internal processes for handling and protecting user data. These are critical for building trust and ensuring compliance.

A privacy policy is a promise. Your security measures are how you keep that promise, demonstrating to users and regulators that you take their data protection seriously.

• Data Security Measures: Outline the technical and organizational measures you have in place to protect personal data from breaches, loss, or unauthorized access (e.g., encryption, access controls).
• Data Retention Periods: Specify how long you will store different categories of personal data and why. You cannot keep data indefinitely without justification.
• Third-Party Disclosures: List any third parties with whom you share personal data (e.g., payment processors, analytics services) and for what purpose.
• Cross-Border Data Transfers: If you transfer data outside of Nigeria, you must state this and ensure the recipient country has adequate data protection laws or that other safeguards are in place, as stipulated by the Nigeria Data Protection Commission (NDPC).
• Data Breach Protocol: Describe your process for handling a data breach, including how and when you will notify affected individuals and the NDPC.

The Items Businesses Often Miss

From our experience providing comprehensive legal services, we see businesses, especially startups, overlook a few key items that can lead to major compliance gaps.

1. Vague Lawful Basis: Many policies just say “we collect data with your consent.” This is insufficient. The NDPA recognizes multiple lawful bases. If you process data to fulfill a contract (e.g., a shipping address for an e-commerce order on a site like Konga.com), the basis is “contractual necessity,” not consent. Failing to specify the correct basis for each processing activity is a common mistake.
2. No Defined Retention Periods: A policy that says “we keep your data as long as necessary” is non-compliant. You must define “necessary.” For example, “Contact form submissions are kept for six months, while customer account information is retained for the duration of the account plus six years to comply with financial record-keeping obligations.”
3. Ignoring Data Subject Rights Procedures: It is not enough to simply list user rights. You must have a practical, accessible process for users to exercise them. Your policy should state how a user can make a request (e.g., “email privacy@yourcompany.com”) and your expected timeframe for a response. The nigeria data protection act 2023 is clear on the obligations of data controllers in this regard.

Copyable Summary Checklist

• [ ] State Data Controller identity and contact information.
• [ ] List all types of personal data collected.
• [ ] Specify the lawful basis for each processing activity.
• [ ] Detail how the data is used.
• [ ] Include a clear cookie disclosure.
• [ ] Explain user rights: access, rectification, erasure, restriction, portability.
• [ ] Describe the process for obtaining explicit consent.
• [ ] Outline data security measures implemented.
• [ ] Define specific data retention periods.
• [ ] Disclose any third-party data sharing.
• [ ] Detail policy for cross-border data transfers.
• [ ] Establish a data breach notification procedure.
• [ ] Provide contact information for the Data Protection Officer (if applicable).
• [ ] Explain how users can lodge complaints.

Further reading

• privacy policy – nitda
• privacy policy – standards organisation

FAQ

What is the main law governing data privacy in Nigeria?

The primary law is the Nigeria Data Protection Act (NDPA) 2023, which was signed into law on June 12, 2023. It established the Nigeria Data Protection Commission (NDPC) to regulate data protection in the country. This Act supersedes the previous Nigeria Data Protection Regulation (NDPR) 2019.

Do I need a privacy policy for a simple blog with a contact form?

Yes. If your contact form collects any personal information (like a name or email address), you are processing personal data and must have a privacy policy that complies with the NDPA. This applies to all websites, regardless of size, that process the personal data of Nigerian citizens.

What are the penalties for not having a compliant privacy policy in Nigeria?

The NDPA 2023 sets significant fines for non-compliance. For a data controller of major importance, the fine is the greater of ₦10 million or 2% of its annual gross revenue of the preceding financial year. For other data controllers, the fine is the greater of ₦2 million or 2% of its annual gross revenue. Beyond fines, you risk reputational damage and civil action from affected individuals.

How is the NDPA different from the GDPR?

The NDPA shares many principles with Europe’s general data protection regulation (gdpr), such as lawful bases for processing and data subject rights. However, it has provisions specific to Nigeria, such as the thresholds for appointing a Data Protection Officer and specific requirements for cross-border data transfers. Businesses operating globally need to ensure they comply with all relevant regulations.

How often should I update my privacy policy?

You should review and update your privacy policy at least annually, or whenever you change your data processing activities. This includes launching new products, using new third-party services, or collecting new types of personal data. Informing users of material changes is a key part of transparency.

Ensuring your website has a compliant privacy policy is a critical legal safeguard. As a firm advising various public and private companies, we understand that navigating these requirements can be complex. If you need assistance drafting or reviewing your policy to meet all legal standards, please get in touch by visiting our contact page.

Related reading

• Nigeria Privacy Policy Requirements 2026.