NDPA Section 27 · Free · No email required
Nigeria Privacy Policy Generator — Free, NDPA 2023 Compliant
A free, open-source privacy-policy generator built for Nigerian apps. Generates the disclosures NDPA 2023 Section 27 requires — lawful basis, data-subject rights, retention, cross-border transfers, sensitive data, children's data, automated decisions, and the NDPC complaint route — with HTML / Markdown / PDF / DOCX export. No email signup, no SaaS lock-in.
What Nigerian law requires in a privacy policy
NDPA 2023 Section 27(1) lists the information a data controller must provide to data subjects before collecting personal data. The privacy policy is the standard surface for these disclosures:
- Identity and contact details of the controller (and the DPO under Section 32).
- Specific lawful basis for processing under Section 25(1) or Section 30(1) (for sensitive personal data).
- Recipients or categories of recipients — including third-country recipients (cross-border, Section 41).
- Retention period (or the criteria used to determine it).
- Existence of the rights of the data subject under Part VI (Sections 34–38, plus 35 and 36).
- Right to lodge a complaint with the Nigeria Data Protection Commission under Section 46(1).
- Existence of automated decision-making, including profiling (Section 37), and meaningful information about the logic involved.
The NDPR Toolkit generator covers all of these, with section references baked into the output so your DPO can verify compliance at a glance.
Sections the generator includes
- Identity & contact — organisation, address, website, privacy contact, DPO.
- Data we collect — itemised by category, with purpose for each.
- Lawful basis — consent, contract, legal obligation, vital interests, public interest, legitimate interests; cited to Section 25(1)(a)–(f).
- Sensitive personal data — only included when applicable; cites Section 30.
- Children's data — conditional section citing Section 31 and Nigeria's Child's Right Act parental-consent requirements.
- Data-subject rights — access (S.34(1)(a)–(b)), rectification (S.34(1)(c)), erasure (S.34(1)(d) + S.34(2)), restriction (S.34(1)(e)), withdraw consent (S.35), object (S.36), automated decisions (S.37), portability (S.38).
- Retention — per-category retention or the criteria used to set it.
- Cross-border transfer — conditional section citing Section 41 mechanisms, Section 42 adequacy, and Section 43 derogations.
- Automated decision-making — conditional section citing Section 37 with the right to human intervention.
- Complaint route — how to contact the NDPC under Section 46(1).
Use it as a SaaS or self-host
The generator is a React component; you can either run it inside your own admin / DPO portal, or use the headless usePrivacyPolicy hook to build a custom UI on top of the policy engine. Either way the output is the same: a typed PrivacyPolicy object that you can render to HTML, Markdown, PDF, or DOCX via the exportHTML / exportMarkdown / exportPDF / exportDOCX helpers.
import { NDPRPrivacyPolicy } from '@tantainnovative/ndpr-toolkit/presets';
<NDPRPrivacyPolicy
organization={{ name: 'Acme NG', address: 'Lagos, Nigeria', dpoEmail: 'dpo@acme.ng' }}
features={{ hasChildrenData: true, hasCrossBorderTransfer: true }}
/>;Not legal advice
Every artifact this toolkit produces — including the privacy policies generated here — ships with a clear "not legal advice" notice. NDPC's subsidiary guidance evolves; your DPO or qualified Nigerian privacy counsel should sign off on the final wording before publication. The generator covers the Section 27 list mechanically; counsel makes the judgement calls.
Not sure what to put in the policy?
The free 5-minute audit walks you through every Section 27(1) disclosure — and 7 other compliance areas — and tells you exactly what to add.
Run the free NDPA audit →Frequently asked questions
Does the Nigeria Data Protection Act require a privacy policy?+
Effectively, yes. NDPA 2023 Section 27 requires a data controller to provide data subjects with specified information before (or at the point of) collecting their personal data. A published privacy policy is the standard way to meet that “provision of information” duty, so any Nigerian website or app that collects personal data needs one.
What must a Nigerian privacy policy include under the NDPA?+
Section 27(1) requires the controller’s identity and contact details (and the DPO under Section 32), the specific lawful basis (Section 25(1), or Section 30 for sensitive data), recipients including any cross-border transfers (Section 41), the retention period, the data-subject rights under Part VI (Sections 34–38), the right to complain to the NDPC (Section 46), and any automated decision-making (Section 37). The generator produces all of these.
Is the privacy policy generator free, and do I need to give an email?+
It is free and MIT-licensed, with no email signup and no SaaS lock-in. You run it inside your own app or DPO portal, so the generated policy and any data you enter never leave your environment.
What formats can I export the privacy policy to?+
HTML, Markdown, PDF and DOCX, via the exportHTML, exportMarkdown, exportPDF and exportDOCX helpers. The underlying output is a typed PrivacyPolicy object, so you can also render it however you like.
Does it handle sensitive personal data and children’s data?+
Yes. The generator includes a conditional sensitive-personal-data section citing Section 30, and a children’s-data section citing Section 31 and the Child’s Right Act parental-consent requirement — each included only when your configuration says they apply.
Is the generated policy legal advice?+
No. Every artifact ships with a clear “not legal advice” notice. The generator covers the Section 27 disclosure list mechanically, but your DPO or qualified Nigerian privacy counsel should review the final wording before publication.