NDPC Data Breach Notification (Nigeria)

A NDPC Data Breach Notification in Nigeria records the ndpc data breach notification and the particulars that give it legal effect.

The Nigeria Data Protection Act 2023 was enacted on 14 June 2023 and replaced the Nigeria Data Protection Regulation 2019 (NDPR 2019) as the primary personal data protection law in Nigeria. The NDPA 2023 established the Nigeria Data Protection Commission (NDPC) as an independent statutory body with powers to regulate personal data processing, investigate breaches, and impose administrative sanctions of up to 2% of annual gross revenue (or NGN 10 million, whichever is higher) for violations under Section 48 of the Act.

Under Section 40(1) of the NDPA 2023, a data controller must notify the NDPC of a personal data breach without undue delay and, where feasible, within 72 hours of becoming aware of the breach. Where notification cannot be made within 72 hours, the reasons for delay must be provided with the notification. Section 40(2) requires that the notification contain: the nature of the breach; the categories and approximate number of data subjects affected; the categories and approximate number of personal data records affected; the name and contact details of the Data Protection Officer (DPO) or other contact point; the likely consequences of the breach; and the measures taken or proposed to address the breach, including measures to mitigate its possible adverse effects.

Data controllers must also notify affected data subjects when the breach is likely to result in a high risk to their rights and freedoms, under Section 41 of the NDPA 2023. The subject notification must be communicated to affected individuals directly (by email, SMS, or letter) without undue delay.

The NDPC published its Data Breach Management Guidelines in 2024, providing operational guidance on breach classification (low, medium, high, critical), notification procedures, and post-breach remediation requirements for data controllers registered under the NDPA 2023.

The legal framework governing the NDPC Data Breach Notification (Nigeria) in Nigeria draws on several key statutes and regulatory bodies. Under Nigerian law, the Companies and Allied Matters Act 2020 (CAMA) regulates corporate entities through the Corporate Affairs Commission (CAC). The Labour Act (Cap L1 LFN 2004) and the National Industrial Court of Nigeria (NICN) govern employment disputes. The Nigeria Data Protection Regulation (NDPR) 2019 and the Nigeria Data Protection Commission (NDPC) protect personal data. The Federal Inland Revenue Service (FIRS) administers tax obligations under the Companies Income Tax Act. The Federal High Court and state High Courts have jurisdiction over civil matters. Parties executing a NDPC Data Breach Notification (Nigeria) in Nigeria should confirm the document reflects current law, including any amendments enacted since the original drafting date. The Companies and Allied Matters Act (CAMA) 2020 sets the foundational requirements.

An NDPC Data Breach Notification in Nigeria is required whenever a personal data breach occurs that meets the notification threshold under Section 40 of the NDPA 2023.

An NDPC Data Breach Notification is needed when a company's database containing customer personal data (names, phone numbers, BVNs, NINs, account numbers, or medical records) is accessed by an unauthorised party — for example, through a cyberattack, ransomware incident, SQL injection, or data exfiltration by a malicious insider.

An NDPC Data Breach Notification is required when personal data is accidentally exposed — for example, by publishing a file containing personal data on a publicly accessible server, emailing personal data to the wrong recipient, or inadvertently disclosing customer data in a document shared with a third party.

An NDPC Data Breach Notification is needed when a data processor (such as a cloud service provider, payroll company, or outsourced IT service provider) suffers a breach involving the personal data of a Nigerian data controller's data subjects. Under Section 40(3) of the NDPA 2023, the processor must notify the data controller promptly upon discovering the breach, enabling the controller to fulfil its own 72-hour notification obligation.

An NDPC Data Breach Notification is required when physical documents containing personal data (such as printed customer records, employee files, or medical records) are lost, stolen, or destroyed without proper authorisation.

An NDPC Data Breach Notification is needed when a third-party payment processor, fintech partner, or API integration exposes personal data of Nigerian customers through a vulnerability in the shared technology infrastructure.

An NDPC Data Breach Notification is required even if the breach does not yet have confirmed adverse consequences — the 72-hour clock starts from when the data controller becomes aware, not from confirmation of actual harm.

Parties in Nigeria should prepare a NDPC Data Breach Notification (Nigeria) proactively rather than waiting for a dispute to arise. Courts interpret agreements based on the written terms rather than oral representations. Under Nigerian law, the Companies and Allied Matters Act 2020 (CAMA) regulates corporate entities through the Corporate Affairs Commission (CAC). The Labour Act (Cap L1 LFN 2004) and the National Industrial Court of Nigeria (NICN) govern employment disputes. The Nigeria Data Protection Regulation (NDPR) 2019 and the Nigeria Data Protection Commission (NDPC) protect personal data. The Federal Inland Revenue Service (FIRS) administers tax obligations under the Companies Income Tax Act. The Federal High Court and state High Courts have jurisdiction over civil matters. Where the transaction involves regulated activities, prior approval from the relevant authority may be required before execution.

A valid NDPC Data Breach Notification under Section 40 of the NDPA 2023 must contain the following essential elements.

Data Controller Identity: Full legal name, CAC registration number, NDPC registration number (all data controllers processing personal data of more than 2,000 data subjects annually must register with the NDPC), registered address, and contact details of the Data Protection Officer (DPO) appointed under Section 34 of the NDPA 2023.

Nature of the Breach: A precise description of what happened — the type of security incident (hacking, accidental disclosure, insider breach, physical loss), how the breach occurred, the vulnerability or failure that enabled the breach, and the date and time the breach occurred and was discovered.

Categories of Personal Data Affected: Specification of the types of personal data involved — identifying information (name, NIN, BVN), contact data, financial data, health data, biometric data, or other sensitive categories under Section 30 of the NDPA 2023. Special categories of data (health, biometric, genetic) attract heightened reporting obligations.

Scope of Impact: The approximate number of data subjects affected and the approximate number of personal data records compromised. If the exact number is unknown at time of notification, the best available estimate must be provided with an undertaking to update the NDPC.

Likely Consequences: An assessment of the likely consequences of the breach for data subjects — including risks of identity theft, financial fraud, discrimination, damage to reputation, or physical harm — to enable the NDPC to assess notification priority.

Remediation Measures: A description of the measures already taken to contain the breach (e.g., isolating affected systems, resetting compromised credentials, engaging a cybersecurity incident response firm) and proposed measures to prevent recurrence.

Data Subject Notification: Whether affected data subjects have been or will be notified under Section 41 of the NDPA 2023, including the communication channels and timeline for subject notification.

Additional compliance elements for a NDPC Data Breach Notification (Nigeria) used in Nigeria include: Under Nigerian law, the Companies and Allied Matters Act 2020 (CAMA) regulates corporate entities through the Corporate Affairs Commission (CAC). The Labour Act (Cap L1 LFN 2004) and the National Industrial Court of Nigeria (NICN) govern employment disputes. The Nigeria Data Protection Regulation (NDPR) 2019 and the Nigeria Data Protection Commission (NDPC) protect personal data. The Federal Inland Revenue Service (FIRS) administers tax obligations under the Companies Income Tax Act. The Federal High Court and state High Courts have jurisdiction over civil matters. Forms-legal.com provides this template as a starting point for Nigeria-compliant documentation.