NDPA Section 28 · Free · Open source
Nigeria DPIA Tool — NDPA Section 28 Compliant
A complete Data Privacy Impact Assessment workflow for Nigeria's Data Protection Act 2023. Stepped questionnaire, weighted risk scoring, mitigation tracking, NDPC prior-consultation flag, and PDF/DOCX export — all as a typed React component or a headless hook you can wrap in your own UI.
When do I need a DPIA under Nigerian law?
NDPA 2023 Section 28(1) requires a Data Privacy Impact Assessment beforeany processing that is likely to result in a high risk to the rights and freedoms of data subjects. The NDPC's General Application and Implementation Directive (GAID) 2025 reinforces DPIAs as an expectation for Data Controllers and Processors of Major Importance (DCPMI) — not sure if that's you? Check your likely designation with the DCPMI designation classifier. In practice, a DPIA covers:
- Large-scale processing of sensitive personal data (Section 30) — health, biometric, financial, religious, political, ethnic, children.
- Systematic monitoring of publicly accessible areas (CCTV, surveillance, geo-location).
- Automated decision-making with legal or similarly significant effects (Section 37 territory).
- Combining datasets in ways data subjects would not reasonably expect.
- Any processing the NDPC has formally designated high-risk in subsidiary guidance.
Under Section 28(2), if residual risk after mitigation remains high, the controller must consult the NDPC before proceeding. The DPIA tool surfaces this consultation requirement automatically as part of the result.
What the tool does
- Stepped questionnaire — multi-section flow covering project overview, data flows, data subjects, lawful basis, risks, and mitigations. Progress indicator + per-section validation.
- Weighted risk scoring — each risk gets a likelihood × severity score; mitigated risks reduce the residual level.
- NDPC consultation flag — the result returns
requiresConsultation: truewhen residual risk is high or critical, matching Section 28(2). - Audit-friendly output — deterministic PDF + DOCX export with the legal notice footer the NDPR Toolkit ships everywhere.
- Headless mode — if the default UI is too opinionated, use the
useDPIAhook +DPIAProvidercompound API and build your own. - Persistence — long DPIAs save progress via any
StorageAdapter(localStorage by default).
Install
pnpm add @tantainnovative/ndpr-toolkitDrop the preset into any client component:
// app/dpia/page.tsx
'use client';
import { NDPRDPIA } from '@tantainnovative/ndpr-toolkit/presets';
export default function DPIAPage() {
return (
<NDPRDPIA
onResult={(result) => {
fetch('/api/dpia', { method: 'POST', body: JSON.stringify(result) });
}}
/>
);
}Built for Nigerian compliance teams
Every label, section reference, and consultation prompt is derived from the gazetted text of the NDPA 2023 (not GDPR, not Nebraska's NDPA). Section numbers are consistent with the Act as published — if NDPC issues subsidiary guidance that changes thresholds, the toolkit's open-source repo accepts PRs from privacy practitioners.
Want to know your overall NDPA risk?
The DPIA tool covers Section 28. The free 5-minute audit scores your whole compliance posture across all 8 NDPA modules with prioritised fixes.
Run the free NDPA audit →Frequently asked questions
When is a DPIA required under the Nigeria Data Protection Act?+
NDPA 2023 Section 28(1) requires a Data Privacy Impact Assessment before any processing likely to result in a high risk to the rights and freedoms of data subjects — for example large-scale processing of sensitive data (Section 30), systematic monitoring of public areas, automated decisions with significant effects (Section 37), or combining datasets in unexpected ways. The NDPC’s GAID 2025 also expects DPIAs from Data Controllers and Processors of Major Importance (DCPMI).
What is a DPIA under NDPA 2023?+
A Data Privacy Impact Assessment is a documented analysis of a processing activity that identifies the data flows and data subjects involved, scores the privacy risks by likelihood and severity, records mitigations, and determines the residual risk. It is how a controller demonstrates it considered privacy risk before processing, as required by Section 28.
When must I consult the NDPC about a DPIA?+
Under Section 28(2), if the residual risk remains high after you apply mitigations, you must consult the Nigeria Data Protection Commission before proceeding. The tool surfaces this automatically: the result returns requiresConsultation: true when the residual risk is high or critical.
Is the DPIA tool free and open source?+
Yes — it is MIT-licensed and free. You can use the drop-in NDPRDPIA preset component, or the headless useDPIA hook with the DPIAProvider compound API to build your own interface on top of the same scoring engine.
Can I export the completed DPIA?+
Yes. The tool produces deterministic PDF and DOCX exports, each carrying the “not legal advice” notice the toolkit ships everywhere, so the assessment is ready to file in your compliance records or hand to your DPO.