NDPA Compliance for Small Businesses: A Practical Checklist

NDPA compliance for small businesses means following the Nigeria Data Protection Act 2023 whenever you collect names, phone numbers, health details or photos. Have a lawful reason, tell people why and get consent before marketing. Keep records secure, report serious breaches within 72 hours and register with the NDPC if you cross its thresholds.

This guide is for the school bursar, clinic manager, church administrator and salon owner. It is general information, not legal advice. For a specific case, speak to a lawyer or a licensed Data Protection Compliance Organization (DPCO).

NDPA compliance for small businesses: what applies to you

The Nigeria Data Protection Act 2023 covers organizations of every size that handle personal data in Nigeria. “Processing” covers collecting, storing, sharing and deleting it. A school’s admissions, a pharmacy’s customer list and an NGO’s beneficiary register all count. The core principles apply whatever your size. Size mainly decides registration and annual audit filing.

Since 19 September 2025, the detailed rules have been in the GAID 2025 (General Application and Implementation Directive). The Nigeria Data Protection Commission (NDPC) issued it on 20 March 2025, and it replaced the NDPR 2019 and its 2020 Implementation Framework. If your privacy policy still quotes the NDPR, update it.

Key terms in plain English: personal data, sensitive data and controller

Personal data: anything that identifies a living person, such as a name, phone number, address or photo.
Sensitive personal data: data that needs extra care, including health records, religious beliefs, biometrics such as fingerprints, ethnic origin and political opinions. Clinic patient files, a church membership roll and a fingerprint attendance clock all count.
Data controller: the organization that decides why and how data is used, such as the school itself.
Data processor: anyone who handles data on your behalf, such as a payroll bureau or IT support company.

Do you need to register with the NDPC? The major-importance test

Only “data controllers and processors of major importance” must register with the NDPC. They must do so within six months of becoming one. The Commission decides who counts, mainly by how many people’s data you handle. The GAID sorts these organizations into three tiers: Ultra-High Level (UHL), Extra-High Level (EHL) and Ordinary-High Level (OHL).

The NDPC’s FAQs and guidance put the lower line for data controller of major importance registration at about 200 data subjects within six months. Volume is not the only test: the GAID also weighs factors such as how sensitive the data is. Confirm your tier with the NDPC.

Your situation	What it likely means
A small salon or shop with well under 200 customers in six months and no sensitive data	Probably below the line; the rest of this guide still applies.
A school, clinic, church or NGO holding records on more than 200 people in six months	Check whether you must register. Sensitive data, such as health or religious information, adds weight.
Registered in the OHL tier	Renew your registration every year. You do not file an annual Compliance Audit Return (CAR).
Registered in the UHL or EHL tier	File a CAR every year through a licensed DPCO. The deadline is 31 March if you were established before 12 June 2023. If you started later, file within 15 months of establishment and every year after that.

A late CAR costs the filing fee plus a 50% penalty. Fees vary by tier, so check the current schedule with the NDPC.

Do you need a data protection officer in Nigeria?

Section 32 of the Act covers the data protection officer (DPO). Organizations of major importance are expected to designate a DPO with expert knowledge of data protection law. The DPO can be a staff member or a contractor. If you are below the line, still name one person who owns this checklist.

Lawful basis and consent for marketing messages on forms, WhatsApp and email lists

Section 25 gives six lawful bases for processing, and consent is only one. The others are a contract (an address taken for a delivery), a legal obligation (payroll records), vital interests (an emergency), a public interest task and legitimate interests that do not override the person’s rights.

Consent must be a real choice: as easy to withdraw as to give, and refusing must not disadvantage the person. Silence or a pre-ticked box does not count. The GAID requires consent for direct marketing, and section 36 lets people object to it.

Registration forms: an admission or membership form should say what the data is for and include a separate, unticked box for promotions. Our free Registration Form Maker runs in your browser, and what you type stays there until you choose to save it.
WhatsApp broadcasts: add only people who agreed to receive offers. A number collected for a delivery is not permission. If someone replies “stop”, remove them.
Email lists: record how and when each person signed up, and include an unsubscribe line in every marketing email.
Children: for pupils, consent must come from a parent or guardian.

Privacy notices and your privacy policy in Nigeria: websites, forms and premises

When you collect data, section 27 requires you to tell people who you are, why you need it, your lawful basis and how long you will keep it. You must also explain their rights, including the right to complain to the NDPC. That is your privacy notice. A privacy policy in Nigeria need not be long, but it must be accurate.

Website: link a privacy policy page from the footer and from every contact or booking form.
Paper forms: add a short note saying who is collecting the data, why and where to read the full notice.
Premises and CCTV: put up a visible sign saying cameras are recording, who runs them, why and whom to contact. Limit who can view footage and delete it on a fixed cycle.
Email: link your privacy notice in staff signatures; the free Email Signature tool keeps them consistent.

Protecting records: access, passwords, paper files and devices

The Act expects appropriate technical and organizational measures to keep data secure. For a small organization, that means simple daily habits:

Give each staff member their own login rather than a shared front-desk password.
Turn on two-step verification for email, WhatsApp Business and cloud storage.
Lock patient folders, pupil records and payroll files away.
Set a passcode on every phone and laptop holding customer data.
Remove a leaver’s access on their last day.
Keep data only as long as you need it, then shred or delete it.
Write confidentiality duties into the staff letters you prepare with the HR Letter Writer. Put data protection terms in contracts with vendors who handle your data, for example with the Service Agreement tool.

Requests from customers and the complaints process

Sections 34 to 38 give people rights to know how their data is used, get a copy, correct mistakes, have it erased in some cases, withdraw consent and object. Under section 46, anyone can complain to the NDPC.

Decide how requests come in and who handles them.
Confirm the person’s identity before releasing anything.
Respond promptly, and log each request, its date and what you did.
If you refuse part of a request, explain why.

Data breaches: what to do and who to tell

A breach is any loss, theft or unauthorised access to personal data, such as a stolen laptop or a patient list sent to the wrong WhatsApp group. Under section 40, if a breach is likely to put people’s rights and freedoms at risk, you must notify the NDPC within 72 hours of becoming aware of it. If the risk is high, you must also tell the affected people without undue delay.

Contain it: change passwords or lock the account.
Record what happened, what data was involved, who was affected and when you found out.
Decide whether the breach puts people at risk. If it does, notify the NDPC within 72 hours.
If the risk is high, tell those affected.
Fix the cause and keep the record.

Under section 48, organizations of major importance face penalties of up to ₦10 million or 2% of the previous year’s annual gross revenue, whichever is greater. Other organizations face up to ₦2 million or 2%, whichever is greater.

A one-page NDPA checklist for small organizations

List the personal data you collect, where it is kept and who can see it.
Mark sensitive data and children’s records.
Note the lawful basis for each use.
Check your tier and, if you qualify, register within six months.
If you are UHL or EHL, put the 31 March CAR in your calendar and engage a licensed DPCO.
Name a responsible person, or a DPO if you are of major importance.
Publish privacy notices online, on forms and at your premises, citing the NDPA and the GAID 2025.
Use separate, unticked boxes for marketing consent, and honour opt-outs.
Secure accounts, devices and paper files.
Put data protection terms in vendor contracts.
Keep a request log, a breach log and a 72-hour breach plan.
Brief staff and review this list every year.

For help setting up the forms, notices and digital routines behind this checklist, see how I work with schools, clinics, NGOs, faith groups and shops, or browse my digital operations solutions.

Frequently asked questions

Does the NDPA apply to small businesses?

Yes. The Nigeria Data Protection Act 2023 applies to organizations of any size that process personal data in Nigeria. What changes with size is mainly registration and annual audit filing, which apply to data controllers and processors of major importance as defined by the NDPC.

Who must file a Compliance Audit Return?

Under the GAID, organizations in the Ultra-High and Extra-High tiers file a CAR every year through a licensed DPCO, by 31 March if they were established before 12 June 2023. Ordinary-High organizations renew their registration yearly instead and do not file a CAR.

Can I send WhatsApp promotions to customers who bought from me?

Only with their consent for marketing. A number collected for a sale or delivery is not permission for promotional messages. Ask clearly, keep a record of who agreed, and stop as soon as someone objects. Section 36 gives people a right to object to direct marketing.

How quickly must a data breach be reported?

If a breach is likely to put people’s rights and freedoms at risk, section 40 requires you to notify the NDPC within 72 hours of becoming aware of it. If the risk to them is high, you must also inform the affected people without undue delay.