NDPA COMPLIANCE
Nigeria Data Protection Act compliance checklist
A practical board and operations checklist for assessing privacy governance, accountability evidence, security controls and regulatory readiness under Nigeria’s data protection regime.
A practical compliance baseline for accountable data use
The Nigeria Data Protection Act requires organisations to prove they understand what personal data they process, why they process it, how it is protected, who is responsible and how data subject rights and incidents are handled. This checklist helps leadership, DPOs and operational teams identify gaps before a regulator, client or partner asks for evidence.
Core compliance pillars
Governance and accountability ownership
Lawful basis, transparency and consent
Security, breach response and processor control
Training, records and continuous improvement
NDPA compliance checklist
Use these checks to assess whether your privacy programme can demonstrate accountability, operational control and evidence readiness.
Governance and accountability
Appoint a responsible privacy lead or DPO where required.
Maintain policies approved by leadership and understood by teams.
Keep evidence of accountability decisions, reviews and approvals.
Data mapping and lawful basis
Record categories of personal data, purposes, sources and recipients.
Confirm lawful basis for each major processing activity.
Identify high-risk processing that needs a DPIA before launch.
Transparency and rights handling
Publish clear privacy notices for customers, staff and users.
Define a process for access, correction, deletion and objection requests.
Keep response logs and escalation evidence for rights requests.
Security and breach response
Apply access controls, encryption, backups and secure configuration.
Maintain a breach response plan with reporting roles and timelines.
Test incident escalation through tabletop exercises or simulations.
Processors and transfers
Inventory vendors and processors with access to personal data.
Put data processing agreements and security obligations in place.
Review cross-border transfers and supporting safeguards.
Training and evidence
Train staff on privacy, customer data handling and breach awareness.
Keep attendance records, assessments and refresher schedules.
Review policies, records and controls at least annually.
A readiness model built for evidence, not guesswork
01 Assess
Map processing, roles, lawful basis, notices, vendors and security controls.
02 Remediate
Prioritise policy, training, contract, DPIA and incident-response gaps.
03 Evidence
Create a practical record set leadership can rely on during reviews.