The Nigeria Data Protection Act, for a business with five staff

It probably applies to you

If you hold customer names, phone numbers, addresses or payment details, and almost every business does, you are processing personal data under the Nigeria Data Protection Act 2023.

The four practical duties

1. 1Collect only what you need and say why you are collecting it.
2. 2Keep it secure, a shared phone with no passcode is not secure.
3. 3Delete it when it is no longer needed.
4. 4Respond when a customer asks what you hold about them.

The annual audit

Organisations processing personal data at scale file an annual audit report with the NDPC through a licensed compliance organisation. The deadline is 15 March. Penalties reach up to 2% of annual gross revenue.

Specialist check: whether the audit threshold applies to your business is a judgement call. Rizekit's compliance team will confirm it for you.