The Nigeria Data Protection Act 2023 requires data controllers of major importance to designate a data protection officer (DPO) with expert knowledge of data protection law and practice. The DPO advises the organisation, monitors compliance and acts as the contact point for the Nigeria Data Protection Commission.
The NDPA allows the DPO to be an employee or engaged under a service contract. Many organisations, particularly growing companies and those without an in-house legal team, find an outsourced DPO more practical and more cost-effective than a full-time hire.
What our outsourced DPO service covers
- Acting as your designated data protection officer and point of contact for the NDPC
- Keeping your records of processing, policies and notices up to date
- Advising on new products, systems, vendors and marketing campaigns as they arise
- Data protection impact assessments for high-risk processing
- Handling data subject requests, such as access and deletion requests, within the legal time limits
- Preparing for and coordinating your annual compliance audit returns; see NDPC registration and compliance audits
- Staff training and awareness
- Leading the response if a breach occurs; see data breach response
- Regular compliance reports to your management or board
How the retainer works
We agree the scope and a fixed monthly fee with you at the start, based on the size of your organisation, the data you process and your sector. Work outside the agreed scope, such as a major investigation or a new product launch, is quoted separately. We review the scope with you regularly so it keeps pace with your business.
Supporting an in-house DPO
If you already have a DPO, we can support them instead: as a second opinion on difficult questions, for audits and training, or to cover absences.
