Written by
Iliya Ashom
Managing Partner
Registration deadlines passed quietly for most Nigerian businesses. We look at where the Commission has moved first, and what a defensible compliance file looks like.
Discuss this matter →Registration deadlines under the Nigeria Data Protection Act came and went quietly for most Nigerian businesses. Two years into the Commission's operational life, a pattern has emerged in what it actually pursues, and it is not what most compliance vendors were selling.
Where enforcement has actually landed
The Commission's early activity has concentrated on three categories: organisations processing large volumes of personal data without a filed audit, entities that suffered a reportable breach and did not report it, and businesses whose privacy notices promise one thing while their systems do another. Sector matters less than volume. A mid-sized lender with two hundred thousand customer records has attracted more attention than a manufacturer with a similar turnover and almost no consumer data.
What has not driven enforcement, so far, is the absence of a Data Protection Officer alone. That obligation is real, but on its own it has rarely been the trigger for an enquiry.
What a defensible file looks like
When the Commission writes to a client, the question is always evidentiary: show us what you decided, when, and on what basis. A file that answers that question generally contains six things.
A current data inventory identifying what is held, where, and on whose authority
The lawful basis recorded for each processing activity, not merely asserted in a policy
Data processing agreements with every vendor that touches personal data
A breach register, including incidents that were assessed and found not to be reportable
Evidence that data subject requests were logged and answered within the statutory window
Dated proof that staff were trained, with the material actually used
The organisations that come through an enquiry well are rarely the ones with the longest policy. They are the ones that can show a decision trail.
The transfer question
Cross-border transfer remains the least settled area. Where a Nigerian entity relies on a group company abroad for hosting or support, the Act requires an adequacy assessment or an appropriate safeguard. In practice, many businesses have neither, and rely instead on consent language buried in a terms-of-service document. That is a weak position, and it is the one most likely to be tested next.
What to do now
For most clients, the useful work is not a fresh policy. It is a short, honest gap assessment: identify the processing activities that carry genuine risk, document the basis for them, and close the vendor contracts that are missing. That exercise typically takes weeks, not months, and it converts an abstract exposure into a manageable list.
This note is a general commentary on the law as at the date of publication. It is not legal advice and should not be relied upon in place of advice on your own facts. For guidance on a specific matter, speak to one of our lawyers.
