NDPA basics for product teams: privacy to build in from day one

Privacy is far cheaper to build in than to bolt on. If you design and build software that handles personal data about people in Nigeria, the Nigeria Data Protection Act 2023 (NDPA) shapes what you should build from the first version. This guide is for product managers, designers and developers. It is general information, not legal advice.

The basics

The NDPA is Nigeria’s main data protection law. It is overseen by the Nigeria Data Protection Commission (NDPC), whose General Application and Implementation Directive (GAID), in effect since 19 September 2025, explains how the Commission expects the Act to be applied.

Personal data is any information that identifies a person directly or indirectly: names, phone numbers, email addresses, locations, ID numbers, device identifiers and more. Some categories, such as health data, are treated as sensitive and need extra care.

The principles, in product terms

The NDPA’s principles translate directly into design decisions:

• Lawful, fair and transparent: have a lawful basis and tell people plainly what you do.
• Purpose limitation: use data only for the purposes you explained.
• Data minimisation: collect only what you need.
• Accuracy: let people correct their details.
• Storage limitation: keep data only as long as necessary.
• Integrity and confidentiality: protect it properly.
• Accountability: be able to show you did all of the above.

Ten things to build in

1. Collect less

Challenge every form field. If you cannot say why you need a date of birth or a home address, do not ask for it. Less data means less risk and less work.

2. Get the lawful basis right

The NDPA allows processing on several bases, including consent, a contract, a legal obligation and legitimate interests. Decide the basis for each purpose before you build, because it changes what the product must do.

3. Make consent count

Where you rely on consent, it must be freely given, specific, informed and unambiguous, and as easy to withdraw as to give. That means no pre-ticked boxes, separate choices for separate purposes, a record of when and how consent was given, and a simple way to change it later.

4. Explain it in the product

Put a clear privacy notice where people make decisions, not only in a footer link. If your product makes automated decisions with significant effects on people, the NDPA expects you to say so and to offer a way for a human to review them.

5. Control access

Give staff access only to the data their role needs. Use multi-factor sign-in for administrators, and keep audit logs of who viewed, changed or exported sensitive records.

6. Build retention in

Decide how long each type of data is kept, then make the system delete or anonymise it automatically. A retention policy that relies on someone remembering is not a retention policy.

7. Support people’s rights

People can ask to access, correct or delete their data, or to receive it in a portable format. Build admin tools to find everything about one person, export it and delete it, so requests take minutes, not days.

8. Secure it properly

Encrypt data in transit and at rest, keep software patched, test your security, and handle passwords and secrets carefully. The NDPA expects appropriate technical and organisational measures, and those are the core of them.

9. Be ready for a breach

Data controllers must notify the NDPC within 72 hours of becoming aware of a breach likely to put people’s rights and freedoms at risk, and in some cases tell the people affected. That deadline is only realistic if your product logs important events, raises alerts and has a response plan someone has practised.

10. Know where data goes

Map every place personal data travels: your hosting, backups, email and SMS providers, analytics and support tools. Transfers outside Nigeria need a lawful basis, such as adequate protection in the destination or appropriate safeguards, so record the basis for each.

High-risk processing and registration

For processing likely to pose a high risk to people, such as large-scale sensitive data, profiling or systematic monitoring, the NDPA requires a data protection impact assessment before you start. Organisations that the law classes as data controllers or processors of major importance must also register with the NDPC. Your data protection officer or lawyer can confirm whether either applies to you.

Working with your advisers

Privacy is a team effort. Lawyers and data protection officers interpret the law; product teams make it real. The most effective approach is to involve both early: agree the purposes, bases and retention periods during discovery, then design the product around them.

Building these features into the first version costs little. Retro-fitting them into a live product, under pressure from a complaint or a breach, costs a great deal more.