An online shop in Nigeria might collect a buyer's name, delivery address, phone number and payment reference before sending an order. Its website may also run analytics, advertising pixels, a customer-support chat tool and marketing email software. All of those activities can involve personal data, but many small businesses publish a generic 'we respect your privacy' paragraph that explains almost none of them.
A useful privacy notice tells people—in language they can understand—who is collecting their information, what will happen to it, the legal reason for doing so, who else may receive it, how long it will be kept and how they can exercise their rights. In 2026, Nigerian website operators should use the Nigeria Data Protection Act, 2023 (NDP Act) and the NDPC's General Application and Implementation Directive (GAID) 2025 as their starting point.
A privacy notice is not the same as obtaining consent. Publishing one does not legalise unlawful tracking, replace a security programme or prove NDPC certification. This step-by-step guide shows what to write, where to publish it and how to test that it matches your real website. Research verified: 2 November 2026.
1. Understand what a privacy notice actually does
Section 27 of the NDP Act requires a controller to provide specified information before collecting personal data directly from individuals, with additional rules for information obtained indirectly. It must be expressed in a clear, concise, transparent, intelligible and accessible privacy policy. Article 27 of GAID reinforces that material information should be understandable, including for vulnerable audiences.
A privacy notice is therefore an explanation of your processing activities. A privacy policy may also describe broader internal and external privacy commitments; many websites combine the two. Terms and conditions govern the commercial relationship, while a cookie notice gives more focused information and choices about tracking. Each serves a different purpose.
2. Audit the data your website collects before drafting
Review every place that collects or receives information: registration, checkout, newsletter forms, contact pages, support chats, abandoned-cart campaigns, analytics scripts, payment integrations, delivery booking, fraud controls, staff recruitment and cloud storage. Identify both direct inputs and information automatically collected, such as IP addresses, device information or cookie identifiers.
| Example activity | Possible personal data | Why it matters |
|---|---|---|
| Checkout and delivery | Name, address, phone, purchase details | Order fulfilment and courier disclosure |
| Online account | Email, login records, preferences | Authentication and account support |
| Payment | Payment reference, billing identifiers | Processor and merchant responsibilities |
| Marketing | Email, consent choices, campaign interactions | Separate marketing purpose and consent |
| Analytics and ads | Cookie IDs, IP address, usage events | Tracking choice and third-party access |
| Support | Messages, files, complaint history | Retention and sensitive disclosures |
Do not claim to collect no personal data merely because your checkout uses a third-party payment page. The shop may still receive identifiers, payment results, orders or contact details. Keep a simple inventory that identifies the system, purpose, legal basis, recipient, location and retention rule.
3. State the identity and contact details of the data controller
Section 27 requires the controller's identity, place of business or residence and ways to communicate with it, including representatives where needed. Give the actual registered business or individual operator's name, physical business contact and a monitored privacy email or request channel. A brand name without identifying the controller can be inadequate.
Do not invent a Data Protection Officer's name. Businesses designated controllers or processors of major importance have specific DPO duties, while other businesses should at least provide a functioning privacy contact. You may use a dedicated support email if an appropriate person is responsible for handling rights requests.
4. Explain the purposes and lawful bases—not just a blanket 'consent' statement
Under section 25 of the NDP Act and GAID Article 16, recognised bases include consent, contractual necessity, legal obligation, vital interests, public interest and legitimate interests subject to conditions. Select the basis for each actual activity. The fact that a customer visits your shop does not make consent a universal legal basis for every use of data.
| Purpose | Potential lawful basis to evaluate | What to explain |
|---|---|---|
| Taking an order | Performance of a contract | Using contact and delivery information to fulfil a purchase |
| Keeping tax invoices | Legal obligation | Retention necessary under applicable law |
| Account security | Legitimate interests or another suitable basis | Fraud prevention and account protection |
| Promotional emails | Consent where required | Separate opt-in and easy withdrawal |
| Optional tracking | Consent under the GAID cookie rules | Specific choices before activation |
These are examples, not automatic legal determinations for every company. GAID Article 18 specifically addresses consent for direct marketing and other processing contexts. When relying on consent, keep evidence of the choice, make refusal meaningful and make withdrawal as easy as giving consent. A notice should not say 'by using this site, you agree to everything' as a substitute for a valid consent mechanism.
5. Tell customers which information is shared and with whom
An online store may share delivery addresses with logistics providers, order identifiers with payment services, support requests with a helpdesk vendor and website events with analytics or advertising services. Disclose recipients or meaningful categories, and the purpose for sharing, rather than falsely claiming that customer data is never shared.
Where another organisation processes personal data on the store's behalf, review section 29 of the NDP Act and GAID Article 34 concerning processor responsibilities and written agreements. Distinguish a vendor acting under your instructions from a separate independent controller when relevant. Avoid promising that third parties will never access data if your actual vendor contracts allow access.
6. Explain retention and deletion honestly
A privacy notice should state the retention period or a meaningful and supportable way of determining it. Different records may have different lawful periods: fulfilled-order details, support tickets, marketing preferences, security logs and tax invoices need not remain for the same number of months or years.
Do not write 'we keep all data forever' or invent a blanket 30-day deletion rule. Set an internal retention schedule that considers applicable accounting, tax, dispute and statutory obligations. Explain that a verified deletion request can be limited where certain records must be kept by law or to establish legal claims.
7. Describe data-subject rights and the complaint process
Under sections 34–38 of the NDP Act, individuals have rights relating to information, access, correction, objection, withdrawal of consent, portability, erasure and certain automated decisions, subject to applicable conditions. Tell customers how to submit a request, whether verification may be necessary, and how your team will respond.
Include the right to complain to the Nigeria Data Protection Commission , under section 46 and GAID Article 39. A customer should first have an accessible internal contact for complaints. Avoid promising an invented universal deadline for every type of request; establish a process that meets the time limits applicable to the particular request.
8. Give cookies and advertising tools their own meaningful choices
GAID Article 19 requires clear, conspicuous information about cookies and other tracking tools. Except for limited necessary functionality covered by its provisions, cookies and similar trackers require freely given, informed and specific consent. The GAID calls for explicit accept/reject choices and information about withdrawal.
Place the notice where visitors will see it without scrolling, and ensure non-essential analytics or advertising trackers do not run before the necessary choice is made. Identify categories such as necessary, analytics, advertising and preferences where applicable. Provide a way to change decisions later. A banner that offers only 'Accept' and no meaningful rejection is not the same as an effective choice.
The full privacy notice should link to a current cookie description or preference centre; a banner alone cannot explain every data flow. Review embedded advertising, pixels, chat widgets and videos during implementation. Do not state that all analytics tools are automatically exempt merely because they measure traffic.
9. Disclose international hosting and transfers where they actually occur
A Nigerian e-commerce site may store data with a foreign cloud provider or use support teams and sub-processors abroad. Sections 41–43 of the NDP Act and GAID Article 45 govern international transfers and the available protection mechanisms or other permitted conditions. Identify relevant foreign destinations or recipient categories, and explain the mechanism used when necessary.
Do not write 'your data never leaves Nigeria' without checking hosting, backups, analytics, email and payment-provider arrangements. A generic 'we use secure servers' statement does not satisfy the obligation to assess cross-border transfers.
10. Explain children, sensitive data and automated decisions when relevant
If the service is aimed at children or knowingly processes children's information, address the special consent and protective requirements under the law. Health records, biometrics, financial credentials and other sensitive information can require additional safeguards and lawful justification. An ordinary clothing store should not casually copy a clinic's sensitive-data clauses unless they reflect real processing.
Section 27 also requires relevant disclosure of solely automated decisions and profiling, including their significance and anticipated consequences, with rights to object or challenge as applicable. If automated fraud screening or eligibility scoring significantly affects a person, obtain a proper assessment and meaningful explanation instead of hiding the process in a generic AI clause.
11. Example: A short, adaptable privacy notice for a Nigerian online store
The text below is an educational template, not the privacy notice of FlyingEze or a real merchant. Replace every bracketed item, remove activities that do not occur, verify legal bases and retention rules, and have the completed version reviewed before publishing it as your business's policy.
Privacy Notice — [Registered Business Name]
Last updated: [Date]Who we are. [Registered Business Name], located at [Business Address], operates [Website URL]. For questions or privacy requests, contact [Working Email / Contact Channel].
Information we collect. Depending on how you use our store, we collect [customer name, email, telephone, delivery address, order details, account information, payment reference, device and cookie information—edit to match actual systems].
Why we use it and our legal grounds. We use information to [process purchases and deliver orders] where necessary for our contract with you; [retain legally required records] to comply with applicable law; [protect the service from fraud] where a valid lawful basis applies; and [send optional promotions] where valid consent has been obtained.
Sharing and transfers. We share necessary details with [couriers, payment services, hosting vendors, support providers—identify real categories and purposes]. Where information is transferred internationally, we apply [verified lawful transfer mechanism] where required.
How long we keep data. We retain [order, account, support and marketing information] for [actual period or clear criteria], subject to applicable legal obligations. We delete or anonymise information when its retention is no longer justified.
Your rights. Subject to applicable law, you may request access, correction, deletion, portability or objection, or withdraw consent where it applies. Contact [Working Privacy Email] to make a request. You may also complain to the Nigeria Data Protection Commission at ndpc.gov.ng.
Cookies. We use [necessary functionality] and, if enabled with the required consent, [analytics/advertising or other tools]. Choose or change your preferences at [working cookie settings control].
Changes. We may update this notice and will display the updated date and provide additional notice where appropriate.
Because a template has no knowledge of your actual data flows, do not publish it unchanged. It is particularly important to verify third-party data access, the payment process, international transfers, cookie behaviour and the retention periods before final approval.
12. Place the privacy notice at the right points in the customer journey
Publish a dedicated, accessible privacy page and link to it from the homepage, footer, registration page, checkout, newsletter signup and other important collection points. Use concise just-in-time text when the data collection is sensitive or unexpected. GAID Article 7 specifically addresses homepage privacy and cookie notices and making policies available wherever processing occurs.
The notice should work on mobile as well as desktop. Use descriptive headings, readable typography and plain language, and consider audience accessibility and language needs. A PDF policy hidden inside a menu may technically exist yet still fail the accessibility objective.
13. Test the written promises against the live website
- Inspect the real checkout, registration, contact and newsletter forms, including required fields.
- Review analytics, advertising, chat, social pixels, embedded media and cookie behaviour in a fresh browser session.
- Compare each processing purpose with its documented lawful basis and consent interface where needed.
- Verify every recipient category against current vendors, subprocessors and contracts.
- Match stated retention periods to backups, databases, archives and vendor deletion controls.
- Test the privacy contact, data-subject request process, unsubscribe and cookie preference controls.
- Check foreign hosting and transfers, especially email, payments, analytics and customer-support tools.
- Have the business owner and a qualified privacy adviser review the final notice, then log the version and review date.
A notice promising that customers can delete an account immediately is misleading if there is no request channel or back-office workflow. Privacy documents should follow working controls—not substitute for them.
14. Frequent mistakes to avoid
- Copying a foreign retailer's GDPR notice while omitting Nigeria-specific NDPC complaint information.
- Using a brand name without identifying the controller or providing a working contact.
- Claiming consent for all processing without mapping lawful bases.
- Failing to disclose delivery, payment, analytics or advertising recipients.
- Publishing a cookie banner after trackers have already loaded.
- Inventing retention periods, claiming data never leaves Nigeria or promising absolute security.
- Treating an unchanged sample template as evidence of legal compliance.
- Assuming the existence of a privacy notice means registration or other NDPC obligations are automatically satisfied.
For broader operational guidance, FlyingEze has reported on the NDPC investigation into an alleged CAC data breach and the business-security lessons of an AI-agent-linked incident . Those reports illustrate risks; they are not substitutes for the binding Nigerian legal texts.
Frequently asked questions
Is a privacy notice required if my Nigerian store only uses WhatsApp?
If the business collects personal data directly from customers, section 27 transparency requirements can still apply. Provide suitable information where collection occurs; a conventional website is not a prerequisite.
Do I need consent just to deliver an order?
Not always. Contractual necessity may support appropriate order processing. Optional marketing or tracking needs its own legal assessment and, where required, separate consent.
Can I copy another website's privacy policy?
Use policies as structural references, not as factual descriptions of your own practices. Every notice must reflect actual processing, vendors, retention and contact details.
Does every Nigerian website need to register with NDPC?
No universal registration rule applies to every small website merely because it publishes a privacy notice. Registration as a controller or processor of major importance depends on current classification and processing criteria; core privacy obligations may still apply.
How often should the privacy notice be updated?
Review it whenever the business adds new data uses, vendors, technologies or material retention/transfer changes, and periodically even if operations appear unchanged. Keep a date and change history.
Conclusion
Writing a privacy notice for a Nigerian website or online store is an exercise in transparency. Begin with an honest audit of customer information, explain who is responsible and why each category is needed, disclose relevant recipients and transfers, and give people usable privacy rights and cookie controls.
The strongest privacy notice is not the longest or most legalistic. It is one a customer can understand and one the business can demonstrate is true in its daily operations. Under the NDP Act and GAID 2025, clarity, correct legal bases and practical implementation matter far more than copying a generic template.
