5 Steps to NDPA Compliance for Small Nigerian Businesses

You run a small business in Nigeria. You collect customer names, phone numbers, email addresses, and payment details. You have heard about the Nigeria Data Protection Act (NDPA) 2023, and you know it applies to you, but you are not sure where to start — and you cannot afford expensive consultancy fees.

The good news: you can handle the core requirements of NDPA compliance yourself. This guide walks you through five practical steps, each with free tools to help you get it done.

Step 1: Understand What Data You Collect

Before you can protect personal data, you need to know what you have. This exercise is called data mapping, and the formal version is known as a Record of Processing Activities (ROPA). It sounds intimidating, but for a small business, it is straightforward.

Answer these questions for every part of your business that touches customer information:

What data do you collect? Names, emails, phone numbers, payment details, identification documents?
Why do you collect it? To deliver a product, to send marketing, to comply with tax requirements?
Where is it stored? In a spreadsheet, a CRM, a database, on paper, on a staff member's phone?
Who has access? You, your employees, third-party providers, an accountant?
How long do you keep it? Indefinitely? Until the customer asks? For a fixed period?

Write this down. A simple spreadsheet is sufficient. The point is to have a documented record of what personal data flows through your business.

The NDPA Toolkit's ROPA module provides a structured template you can use to organise this information, or you can explore the interactive data mapping demo to see the process in action.

Step 2: Establish a Lawful Basis for Each Processing Activity

The NDPA says you cannot process personal data without a lawful basis. Section 25 defines six, but for most small businesses, three are relevant:

Consent — The customer has explicitly agreed to you using their data for a specific purpose. This applies to marketing emails, analytics, and any non-essential use of data.

Contract — Processing is necessary to fulfil a contract. If someone orders a product, you need their delivery address. That is contract-based processing — no separate consent required.

Legal Obligation — You are required by law to process the data. Nigerian tax law requires transaction records. You do not need consent to comply with a legal requirement.

Go through your data map from Step 1 and assign a lawful basis to each activity. If you cannot identify one, stop doing it.

The lawful basis tracker in the toolkit helps you document and track which basis applies to each activity.

Step 3: Update Your Privacy Policy

Every business that processes personal data needs a privacy policy. Under the NDPA, your privacy policy must tell customers: who you are, what personal data you collect, why you collect it, what lawful basis you rely on, who you share data with, whether data is transferred outside Nigeria, how long you keep it, what rights customers have, and how they can complain to the NDPC.

Your privacy policy must be written in clear, plain language and be easy to find — linked from your website footer and from any form where you collect personal data.

Do not copy a template from the internet without customising it. A privacy policy that does not reflect your actual data practices creates a false record that could be used against you in an enforcement action.

Step 4: Implement Consent Collection

If any of your processing activities rely on consent as the lawful basis (from Step 2), you need a proper consent mechanism. Under the NDPA, valid consent must be:

Freely given — You cannot refuse service because a customer declined marketing consent.
Specific — Each purpose needs its own consent. Do not bundle them into one checkbox.
Informed — The customer must know what they are consenting to before they consent.
Unambiguous — The customer must take a clear affirmative action. Pre-ticked boxes do not count.

For online businesses, this means a consent form presenting each type of data use separately, with non-essential options defaulting to off.

You also need a withdrawal mechanism. If consent was one click to give, it must be one click to take away. And keep records — document what each customer consented to, when, and how. You may need to demonstrate this to the NDPC.

The consent management module in the toolkit handles all of this, or you can see it in action in the consent demo.

Step 5: Set Up Breach Notification Procedures

A data breach is any incident where personal data is accidentally or unlawfully destroyed, lost, altered, or disclosed to someone who should not have access. This includes a hacked database, a lost laptop with customer files, or an employee emailing customer data to the wrong person.

Under Section 40 of the NDPA, you must notify the NDPC within 72 hours of becoming aware of a breach. If the breach poses a high risk to your customers, you must also notify the affected individuals without undue delay.

For a small business, a breach response plan needs to answer four questions:

Who is responsible for assessing the breach? Designate one person as the first point of contact when a potential breach is discovered.

How do you assess the severity? Not every security incident is a notifiable breach. If no data was accessed, it may not meet the threshold. If customer payment details were exposed, it almost certainly does.

How do you notify the NDPC? Know the process before you need it. Have the contact details ready and know what information is required.

How do you notify affected customers? Draft a template notification in advance. You do not want to be writing communications from scratch under a 72-hour deadline.

The breach notification module in the toolkit provides a structured workflow with built-in timeline tracking to ensure you meet the 72-hour window.

You Can Do This Without a Lawyer

NDPA compliance is not about perfect legal documentation. It is about demonstrating that your business takes personal data seriously, knows what data it holds, has a lawful reason for holding it, and has reasonable measures in place to protect it.

A small business that has completed these five steps is in a far stronger position than one that has done nothing, regardless of whether a lawyer was involved. If your operations grow in complexity or you begin processing sensitive data (health records, biometric data, children's data), legal advice becomes more important. But for most small businesses, these five steps are the foundation.

Get Started Today

The NDPA Toolkit provides free, open-source tools for each of these five steps. Explore the interactive demos to see compliant implementations in action, or read the documentation for detailed guidance on each module.

Every day you wait is another day of unmanaged risk. The five steps above can be completed in a week. Start now.

The NDPA Toolkit is open-source and available on GitHub. Built for Nigerian businesses by Nigerian developers.