Nigeria Privacy Policy Generator — Free, NDPA 2023 Compliant

What Nigerian law requires in a privacy policy

NDPA 2023 Section 27(1) lists the information a data controller must provide to data subjects before collecting personal data. The privacy policy is the standard surface for these disclosures:

• Identity and contact details of the controller (and the DPO under Section 32).
• Specific lawful basis for processing under Section 25(1) or Section 30(1) (for sensitive personal data).
• Recipients or categories of recipients — including third-country recipients (cross-border, Section 41).
• Retention period (or the criteria used to determine it).
• Existence of the rights of the data subject under Part VI (Sections 34–38, plus 35 and 36).
• Right to lodge a complaint with the Nigeria Data Protection Commission under Section 46(1).
• Existence of automated decision-making, including profiling (Section 37), and meaningful information about the logic involved.

The NDPR Toolkit generator covers all of these, with section references baked into the output so your DPO can verify compliance at a glance.

Sections the generator includes

• Identity & contact — organisation, address, website, privacy contact, DPO.
• Data we collect — itemised by category, with purpose for each.
• Lawful basis — consent, contract, legal obligation, vital interests, public interest, legitimate interests; cited to Section 25(1)(a)–(f).
• Sensitive personal data — only included when applicable; cites Section 30.
• Children's data — conditional section citing Section 31 and Nigeria's Child's Right Act parental-consent requirements.
• Data-subject rights — access (S.34(1)(a)–(b)), rectification (S.34(1)(c)), erasure (S.34(1)(d) + S.34(2)), restriction (S.34(1)(e)), withdraw consent (S.35), object (S.36), automated decisions (S.37), portability (S.38).
• Retention — per-category retention or the criteria used to set it.
• Cross-border transfer — conditional section citing Section 41 mechanisms, Section 42 adequacy, and Section 43 derogations.
• Automated decision-making — conditional section citing Section 37 with the right to human intervention.
• Complaint route — how to contact the NDPC under Section 46(1).

Use it as a SaaS or self-host

The generator is a React component; you can either run it inside your own admin / DPO portal, or use the headless usePrivacyPolicy hook to build a custom UI on top of the policy engine. Either way the output is the same: a typed PrivacyPolicy object that you can render to HTML, Markdown, PDF, or DOCX via the exportHTML / exportMarkdown / exportPDF / exportDOCX helpers.

import { NDPRPrivacyPolicy } from '@tantainnovative/ndpr-toolkit/presets';

<NDPRPrivacyPolicy
  organization={{ name: 'Acme NG', address: 'Lagos, Nigeria', dpoEmail: 'dpo@acme.ng' }}
  features={{ hasChildrenData: true, hasCrossBorderTransfer: true }}
/>;

Not legal advice

Every artifact this toolkit produces — including the privacy policies generated here — ships with a clear "not legal advice" notice. NDPC's subsidiary guidance evolves; your DPO or qualified Nigerian privacy counsel should sign off on the final wording before publication. The generator covers the Section 27 list mechanically; counsel makes the judgement calls.