Privacy Policy (Nigeria)

A Privacy Policy in Nigeria sets out the rules and standards the organisation expects those it covers to follow.

The Nigeria Data Protection Act 2023 (NDPA 2023) is the principal legislation governing privacy and personal data protection in Nigeria. The NDPA 2023, signed into law on 12 June 2023, established the Nigeria Data Protection Commission (NDPC) as an independent regulatory body responsible for enforcing data protection standards, issuing guidance, and investigating complaints. The NDPA 2023 superseded and upgraded the Nigeria Data Protection Regulation 2019 (NDPR), which was issued by the National Information Technology Development Agency (NITDA) under the NITDA Act 2007. The NDPR remains partially operative for transitional purposes until fully superseded.

Under Section 24 of the NDPA 2023, every data controller must process personal data lawfully, fairly, and in a transparent manner. Section 34 mandates that data controllers provide data subjects with a privacy notice — the Privacy Policy — at the time personal data is collected. The NDPA 2023 requires the Privacy Policy to state: the identity and contact details of the data controller; the purposes and legal basis for processing; the categories of personal data collected; whether data will be transferred to third parties or outside Nigeria; the data retention period; and the data subject's rights under Sections 34–42 of the NDPA 2023.

Organisations that process the personal data of 1,000 or more data subjects in a 12-month period, or that process sensitive personal data (health data, biometric data, financial data, children's data), must register with the NDPC as data controllers of major importance under Section 30 of the NDPA 2023. Such organisations must also appoint a Data Protection Officer (DPO) under Section 32 of the NDPA 2023 and conduct a Data Protection Impact Assessment (DPIA) for high-risk processing activities.

A Privacy Policy must be distinguished from a Cookie Policy, which specifically addresses the use of browser cookies and similar tracking technologies on websites, and from a Data Processing Agreement (DPA), which governs the relationship between a data controller and a data processor (a third party processing data on the controller's behalf). Websites operating in Nigeria that use cookies and similar technologies must comply with both the NDPA 2023 and the NCC Consumer Code of Practice Regulations for electronic communications services.

The legal framework governing the Privacy Policy (Nigeria) in Nigeria draws on several key statutes and regulatory bodies. Under Nigerian law, the Companies and Allied Matters Act 2020 (CAMA) regulates corporate entities through the Corporate Affairs Commission (CAC). The Labour Act (Cap L1 LFN 2004) and the National Industrial Court of Nigeria (NICN) govern employment disputes. The Nigeria Data Protection Regulation (NDPR) 2019 and the Nigeria Data Protection Commission (NDPC) protect personal data. The Federal Inland Revenue Service (FIRS) administers tax obligations under the Companies Income Tax Act. The Federal High Court and state High Courts have jurisdiction over civil matters. Parties executing a Privacy Policy (Nigeria) in Nigeria should confirm the document reflects current law, including any amendments enacted since the original drafting date. The Companies and Allied Matters Act (CAMA) 2020 sets the foundational requirements.

A Privacy Policy is required in Nigeria whenever an organisation, business, or individual collects or processes personal data of Nigerian residents in the course of a commercial, non-commercial, or professional activity.

A Privacy Policy is needed for every Nigerian business website, mobile application, or digital platform that collects users' names, email addresses, phone numbers, location data, payment information, or any other information that identifies or can identify a person. Under Section 34 of the NDPA 2023, the data controller must provide a privacy notice at or before the point of data collection.

A Privacy Policy is required for Nigerian companies that process employee personal data — including HR records, payroll information, biometric attendance data, and health records — under the Employees' Compensation Act 2010 and the NDPA 2023. The NDPC has issued guidance specifically addressing workplace data processing, and employers must publish an internal privacy notice for employees.

A Privacy Policy is needed for Nigerian fintech companies, banks, and financial institutions that process customers' Bank Verification Numbers (BVN), National Identification Numbers (NIN), transaction records, and financial data regulated by the Central Bank of Nigeria (CBN) Consumer Protection Regulations 2019 and the CBN Operational Guidelines for BVN.

A Privacy Policy is required for Nigerian healthcare providers, hospitals, and telemedicine platforms that process patients' medical records, diagnostic data, prescription information, and health histories — classified as sensitive personal data under Section 30 of the NDPA 2023 requiring heightened protection.

A Privacy Policy is needed for Nigerian e-commerce platforms, online retailers, and delivery services that collect customers' names, addresses, payment card details, and purchase histories to fulfil orders and for marketing purposes under the Federal Competition and Consumer Protection Commission Act 2018 (FCCPC Act).

A Privacy Policy is required for schools, universities, and educational institutions in Nigeria that collect and process students' personal data — including academic records, health information, and disciplinary records — governed by the NDPA 2023 and the Child Rights Act 2003 for students under 18 years of age.

Parties in Nigeria should prepare a Privacy Policy (Nigeria) proactively rather than waiting for a dispute to arise. Courts interpret agreements based on the written terms rather than oral representations. Under Nigerian law, the Companies and Allied Matters Act 2020 (CAMA) regulates corporate entities through the Corporate Affairs Commission (CAC). The Labour Act (Cap L1 LFN 2004) and the National Industrial Court of Nigeria (NICN) govern employment disputes. The Nigeria Data Protection Regulation (NDPR) 2019 and the Nigeria Data Protection Commission (NDPC) protect personal data. The Federal Inland Revenue Service (FIRS) administers tax obligations under the Companies Income Tax Act. The Federal High Court and state High Courts have jurisdiction over civil matters. Where the transaction involves regulated activities, prior approval from the relevant authority may be required before execution.

A NDPA 2023-compliant Privacy Policy for Nigeria must contain the following mandatory elements.

Data Controller Identity: The full legal name, registered address, CAC registration number, and contact details of the data controller, together with the name and contact details of the Data Protection Officer (DPO) where one has been appointed under Section 32 of the NDPA 2023. For data controllers of major importance registered with the NDPC, the NDPC registration number should be stated.

Categories of Personal Data Collected: A specific list of the types of personal data collected — such as names, email addresses, phone numbers, BVN, NIN, payment data, location data, IP addresses, device identifiers, health data, and biometric data. Sensitive personal data under Section 30 of the NDPA 2023 (racial/ethnic origin, health data, biometric data, children's data, financial data) must be identified separately with their enhanced legal basis for processing.

Purposes and Legal Basis for Processing: Each processing purpose must be identified, together with its lawful basis under Section 25 of the NDPA 2023 — which includes consent (Section 25(1)(a)), performance of a contract (Section 25(1)(b)), legal obligation (Section 25(1)(c)), vital interests (Section 25(1)(d)), public task (Section 25(1)(e)), and legitimate interests (Section 25(1)(f)). A vague statement of purposes (such as 'improving services') without a specified legal basis is non-compliant.

Data Retention Period: The period for which personal data will be retained, or the criteria used to determine the retention period, in compliance with the data minimisation and storage limitation principles under Section 24(1)(d)–(e) of the NDPA 2023.

Data Sharing and Third Parties: Identification of categories of third parties with whom data is shared — processors, affiliates, payment gateways, analytics providers, government agencies — and the legal basis for each sharing arrangement. Data Processing Agreements must be in place with all processors under Section 29 of the NDPA 2023.

Cross-Border Data Transfers: Disclosure of any transfer of personal data outside Nigeria, and the safeguards in place — including NDPC-approved adequacy decisions, standard contractual clauses, binding corporate rules, or the data subject's explicit consent — required under Sections 43–45 of the NDPA 2023.

Data Subject Rights: A clear statement of data subjects' rights under Sections 34–42 of the NDPA 2023, including: right of access; right to rectification; right to erasure; right to restriction of processing; right to data portability; right to object; and right to withdraw consent. Contact information for exercising these rights must be provided.

Complaint Mechanism: The right to lodge a complaint with the NDPC at ndpc.gov.ng under Section 48 of the NDPA 2023, and the data controller's internal complaints handling procedure.

Cookies and Tracking Technologies: For websites and apps, a disclosure of the types of cookies and tracking technologies used (essential, analytics, marketing) and the mechanism for consenting to or opting out of non-essential cookies, in line with the Nigerian Communications Commission (NCC) Consumer Protection Regulations.

Policy Update Mechanism: The date of the last update and the procedure by which changes will be communicated to data subjects, including notification of material changes.

Additional compliance elements for a Privacy Policy (Nigeria) used in Nigeria include: Under Nigerian law, the Companies and Allied Matters Act 2020 (CAMA) regulates corporate entities through the Corporate Affairs Commission (CAC). The Labour Act (Cap L1 LFN 2004) and the National Industrial Court of Nigeria (NICN) govern employment disputes. The Nigeria Data Protection Regulation (NDPR) 2019 and the Nigeria Data Protection Commission (NDPC) protect personal data. The Federal Inland Revenue Service (FIRS) administers tax obligations under the Companies Income Tax Act. The Federal High Court and state High Courts have jurisdiction over civil matters. Forms-legal.com provides this template as a starting point for Nigeria-compliant documentation.