Data Protection & Privacy

Data Protection & Privacy Lawyers in Lagos & Abuja

We help businesses comply with the Nigeria Data Protection Act 2023: registration and audits with the NDPC, policies and contracts, data breach response, and an outsourced data protection officer on retainer.

Data protection in Nigeria is now enforced

The Nigeria Data Protection Act 2023 created the Nigeria Data Protection Commission (NDPC) and gave it real powers. The Commission registers organisations that process personal data at scale, requires annual compliance audit returns, investigates complaints and breaches, and fines organisations that fall short. It has already taken action against banks, telecoms operators, e-commerce businesses and others. Any business that holds data about customers, employees or website users in Nigeria has obligations under the Act, including businesses based abroad that serve the Nigerian market. Our data privacy lawyers help you understand what applies to you, put the right policies, contracts and processes in place, and stay compliant as your business changes.

Why clients choose our data protection and privacy lawyers

We make data protection practical. Instead of generic policies, we look at how your business actually collects and uses personal data, and build a compliance programme that fits your products, systems and team. For organisations that need ongoing support, we act as your outsourced data protection officer on a monthly retainer. When something goes wrong, we lead the response to data breaches and NDPC investigations. Our Abuja office works directly with the NDPC, and our Lagos office works with the banks, fintechs and technology companies based there.

Who we act for

Banks, fintechs and insurers Telecoms, technology and e-commerce companies Hospitals, clinics and health technology businesses Schools, universities and large employers Foreign companies offering goods or services to people in Nigeria Startups building apps and platforms that collect personal data

Frequently Asked Questions

Data Protection & Privacy: common questions

Does the Nigeria Data Protection Act apply to small businesses?

Yes. The NDPA applies to any organisation that processes personal data of individuals in Nigeria, whatever its size. Registration with the NDPC and annual audit returns are only required for data controllers and processors of major importance.

What is a data controller or processor of major importance?

It is an organisation that processes personal data on a scale or of a kind that the NDPC treats as particularly important, based mainly on the number of people whose data it processes and the nature of its activities. These organisations must register with the NDPC.

Does my business need a privacy policy in Nigeria?

Yes. The NDPA requires organisations to tell people clearly how their personal data is collected, used, shared and kept. A privacy policy on your website or app is the usual way to do this, and it must reflect how your business actually handles data.

Can we store personal data on cloud servers outside Nigeria?

Yes, provided the data is adequately protected, for example because the destination country has adequate data protection law or because appropriate contractual safeguards are in place. The transfer should be assessed and documented.

What are the penalties for breaching the NDPA?

The NDPC can impose fines of up to the higher of ₦10 million or 2% of annual gross revenue for data controllers and processors of major importance, and up to the higher of ₦2 million or 2% for others, as well as ordering remedial action.

How quickly must a data breach be reported in Nigeria?

Where a breach is likely to result in a risk to individuals' rights and freedoms, the NDPC must generally be notified within 72 hours of the organisation becoming aware of it.

Contact

Speak with our data protection and privacy lawyers

Tell us briefly what you need and a lawyer from our Lagos or Abuja office will respond.

Contact The Firm

Speak with the firm

Discuss your legal requirements with our lawyers.

Contact the firm+234 816 850 4153