Nigeria DPIA Tool — NDPA Section 28 Compliant

When do I need a DPIA under Nigerian law?

NDPA 2023 Section 28(1) requires a Data Privacy Impact Assessment beforeany processing that is likely to result in a high risk to the rights and freedoms of data subjects. The NDPC's General Application and Implementation Directive (GAID) 2025 reinforces DPIAs as an expectation for Data Controllers and Processors of Major Importance (DCPMI) — not sure if that's you? Check your tier with the DCPMI registration classifier. In practice, a DPIA covers:

• Large-scale processing of sensitive personal data (Section 30) — health, biometric, financial, religious, political, ethnic, children.
• Systematic monitoring of publicly accessible areas (CCTV, surveillance, geo-location).
• Automated decision-making with legal or similarly significant effects (Section 37 territory).
• Combining datasets in ways data subjects would not reasonably expect.
• Any processing the NDPC has formally designated high-risk in subsidiary guidance.

Under Section 28(2), if residual risk after mitigation remains high, the controller must consult the NDPC before proceeding. The DPIA tool surfaces this consultation requirement automatically as part of the result.

What the tool does

• Stepped questionnaire — multi-section flow covering project overview, data flows, data subjects, lawful basis, risks, and mitigations. Progress indicator + per-section validation.
• Weighted risk scoring — each risk gets a likelihood × severity score; mitigated risks reduce the residual level.
• NDPC consultation flag — the result returns requiresConsultation: true when residual risk is high or critical, matching Section 28(2).
• Audit-friendly output — deterministic PDF + DOCX export with the legal notice footer the NDPR Toolkit ships everywhere.
• Headless mode — if the default UI is too opinionated, use the useDPIA hook + DPIAProvider compound API and build your own.
• Persistence — long DPIAs save progress via any StorageAdapter (localStorage by default).

Install

pnpm add @tantainnovative/ndpr-toolkit

Drop the preset into any client component:

// app/dpia/page.tsx
'use client';
import { NDPRDPIA } from '@tantainnovative/ndpr-toolkit/presets';

export default function DPIAPage() {
  return (
    <NDPRDPIA
      onResult={(result) => {
        fetch('/api/dpia', { method: 'POST', body: JSON.stringify(result) });
      }}
    />
  );
}

Built for Nigerian compliance teams

Every label, section reference, and consultation prompt is derived from the gazetted text of the NDPA 2023 (not GDPR, not Nebraska's NDPA). Section numbers are consistent with the Act as published — if NDPC issues subsidiary guidance that changes thresholds, the toolkit's open-source repo accepts PRs from privacy practitioners.