A small Nigerian business may hold customer phone numbers in WhatsApp, order addresses in a spreadsheet, employee identity documents on a shared laptop and website analytics in a cloud dashboard. Those records may feel routine, but they are personal data—and mishandling them can harm customers, staff and the business.
In 2026, the principal framework is the Nigeria Data Protection Act, 2023 (NDP Act), together with the Nigeria Data Protection Commission's General Application and Implementation Directive (GAID) 2025 , effective 19 September 2025. The law's core privacy duties reach much further than big banks and technology companies. Yet registration as a data controller or processor of major importance, annual Compliance Audit Returns and the appointment of a statutory Data Protection Officer depend on the organisation's circumstances and classification.
This checklist helps retailers, hotels, clinics, small schools, agencies, online shops and growing startups identify practical next steps. It is general guidance, not a legal certification or a claim that every small business must pay for the same regulatory registration.
1. Know what personal data your business actually handles
Personal data is information relating to an identified or identifiable person. For a typical SME, it can include customer names, addresses, phone numbers, email addresses, transaction histories, device identifiers, staff payroll details, CCTV footage and online account records. Some information—such as health or biometric data—needs particularly careful treatment. A handwritten customer register can be relevant; data protection is not limited to websites or apps.
Create a simple data inventory covering where the information comes from, what it is used for, who sees it, how long it is kept and whether it leaves Nigeria. Include WhatsApp Business contacts, POS and booking software, CRM exports, recruitment forms, cloud backups and external payment tools. Do not overlook shared Google Sheets or files stored on employees' personal devices.
2. Understand controller versus processor responsibilities
A data controller decides why and how personal data will be used; a data processor handles personal data on the controller's behalf. A merchant deciding what customer information to collect for deliveries is generally a controller. Its cloud hosting or outsourced CRM service may act as a processor for certain activities. One organisation can have more than one role.
Under section 29 of the Act and Article 34 of GAID, an organisation that engages processors must address the processor's applicable duties. Keep written agreements covering processing instructions, confidentiality, security, subcontractors, assistance with rights and breaches, and deletion or return of data. Outsourcing a database does not automatically outsource the merchant's accountability.
3. Check if your business must register with NDPC
Not every SME is automatically a Data Controller or Processor of Major Importance (DCPMI). The NDPC's updated registration guidance , incorporated in GAID Schedule 7, recognises Ultra-High Level (UHL), Extra-High Level (EHL) and Ordinary-High Level (OHL) classifications. The assessment can involve the type of organisation, volume of data subjects processed within six months, sensitivity and risks—not turnover alone.
| Illustrative NDPC category | Typical guidance indicator | Important qualification |
|---|---|---|
| UHL | Fintechs, payment gateways and specified major sectors; or over 5,000 people in six months | Check actual designation and current notice |
| EHL | Specified hospitals, higher institutions and other sectors; or over 1,000 but below 5,000 people in six months | Organisational nature can matter |
| OHL | Certain primary/secondary schools, smaller hotels and other listed entities; or over 200 but below 1,000 people in six months | Not every OHL duty is the same as UHL/EHL |
| Outside major-importance class | Some small traders or artisans meeting the notice's conditions | Core privacy duties can still apply |
For example, the guidance lists certain hotels and guest houses with fewer than 50 suites under OHL, while traders with fewer than 15 employees meeting the specified limited-data conditions are among those not designated as major importance. These are not blanket exemptions for every 14-person business. A growing school, clinic or app may fall into a listed category despite modest revenue. Verify current status on the NDPC website or with a licensed compliance adviser before paying registration fees.
4. Separate registration, internal audits and annual audit returns
The GAID expects controllers and processors to assess their privacy practices periodically and maintain evidence of compliance. However, formal NDPC Compliance Audit Returns (CAR) are principally a reporting requirement for DCPMIs in the Ultra-High and Extra-High categories under Article 7 and Article 10. Those subject to the ordinary annual cycle generally file by 31 March, through a licensed Data Protection Compliance Organisation (DPCO). The 31 March 2026 filing concerned the relevant preceding audit period and is now past; the next ordinary cycle must be confirmed for a particular organisation.
The NDPC FAQs explicitly explain that an OHL entity processing fewer than 200 data subjects need not file CAR in that situation but must renew registration annually. This is a crucial distinction: an SME should not be told that all registered businesses automatically owe an identical annual CAR. Check the specific OHL requirements, new-business timelines and whether an NDPC notice applies to you.
5. Identify a lawful basis for each use of personal data
Under sections 24–26 of the Act and GAID Articles 15–26, personal information must be handled lawfully, fairly and transparently. Common lawful bases include consent, performance of a contract, legal obligation, vital interests, public interest and legitimate interests, subject to conditions. Consent is not the only lawful basis and should not be used as a catch-all.
For example, collecting a delivery address may be necessary to fulfil a customer's order, while retaining records for required tax reporting may rely on a legal obligation. Sending unrelated promotional messages may require a different assessment and potentially valid opt-in. Record the purpose and chosen lawful basis for each processing activity, and avoid collecting national identity documents merely because a sales form has a spare field.
6. Publish clear privacy and cookie notices
Customers should know who collects their data, why, the categories involved, relevant recipients, retention approach, cross-border transfers and how to exercise their rights. Draft a privacy notice that accurately describes your actual practices, not a copied template that says you never share data while your shop uses an external CRM or courier service.
For websites, GAID Articles 7 and 19 address privacy and cookie notices and meaningful choices about tracking technologies. Audit advertising pixels, analytics trackers and embedded widgets. Where consent is the required basis, do not activate optional tracking before obtaining valid consent; support withdrawal and respect the user's choice. A privacy-policy link alone does not resolve the legality of all tracking.
7. Respect customer and employee data rights
Sections 34–38 of the Act provide rights that can include being informed, accessing information, rectification, withdrawal of consent, objection, portability and erasure, subject to applicable conditions and exceptions. A small business should have a contact email or channel to receive requests, verify the requester's identity, locate their records and respond in the time and manner legally required.
Maintain a log of the date received, the request, the verification performed, the systems searched, decision and response. A request to delete information does not automatically override statutory retention duties such as accounting records. Explain any lawful reason for retaining particular data instead of simply ignoring the request.
8. Secure records with proportionate technical controls
Section 39 of the Act requires technical and organisational safeguards suited to the risks. For an SME, practical steps can include multi-factor authentication, password managers, restricted staff permissions, encryption for portable devices, timely software updates, secure Wi-Fi, properly tested backups and prompt removal of access when an employee leaves.
Do not expose customer databases, identification documents or export spreadsheets through public links. Log access to sensitive records and limit staff to the branch or duties they genuinely need. The same protections should cover POS terminals, booking software, employee laptops and cloud dashboards. Security tools cannot guarantee zero breaches, but a documented, regularly tested control set makes incidents less likely and easier to investigate.
9. Prepare for a personal-data breach before one happens
Section 40 of the Act requires processors to alert the controller when they become aware of a personal-data breach. A controller must notify the NDPC within 72 hours of becoming aware of a breach likely to result in risk to individuals' rights and freedoms. When the breach is likely to result in high risk, affected individuals must be informed immediately, subject to the Act's communication provisions.
Not every failed login or minor technical fault automatically triggers NDPC notification, but every suspected incident should be assessed and documented. Create an incident log recording discovery time, affected records, risk assessment, containment, recovery and notifications. Assign an incident lead and keep the NDPC's reporting route available. For contextual reporting, FlyingEze covered the NDPC investigation into an alleged CAC data breach ; allegations in a news report should not be treated as proof that an entity was found liable.
10. Review vendors, cloud systems and overseas transfers
A shop may use overseas email marketing, analytics, customer support, cloud hosting or payroll services. Under sections 41–43 of the Act, transferring personal data from Nigeria to another country requires a recognised protection mechanism or another permitted legal basis. Merely ticking 'cloud backup enabled' does not establish compliance.
List all vendors, where their servers and support teams operate, which data they receive and whether sub-processors are involved. Obtain appropriate processing agreements, evaluate security controls, and document the transfer mechanism where required. If the vendor offers an AI feature that analyses customer messages or documents, assess whether those personal details are used to train models, are retained or are sent to additional third parties. FlyingEze's article about an AI-agent-linked data incident explains broader security lessons; the legal rules for Nigeria still come from the NDP Act and NDPC.
11. Conduct a Data Privacy Impact Assessment when needed
Section 28 of the Act and GAID Article 28 address Data Privacy Impact Assessments (DPIAs) where processing is likely to create high risks. A clinic planning sensitive patient-data processing, an app using biometrics or a business deploying extensive customer profiling should assess risks before launching the new operation.
A practical DPIA describes the intended processing, necessity and proportionality, risks to individuals, mitigation controls, responsible staff and residual risks. If the risks cannot be adequately reduced, obtain specialist advice and follow any necessary NDPC consultation or directions. A routine low-risk contact list does not automatically demand the same assessment as biometric identification.
12. Assign responsibilities and train staff
DCPMIs have specific obligations concerning appointment of a Data Protection Officer under section 32 and GAID Article 11. Smaller organisations not within that designation should still nominate a responsible person or privacy champion to coordinate notices, requests, vendor reviews and breach response. Do not assert that every sole trader must hire a full-time DPO.
Train staff handling customer data, from front-desk agents to social-media managers. They should understand phishing, secure document sharing, the risks of forwarding customer lists to personal WhatsApp groups, password security and what to do when a laptop is lost. GAID Article 7 also provides for employee privacy training within six months of commencement and then at least annually.
13. Small-business data protection compliance checklist for 2026
| Check | Evidence or action | Priority |
|---|---|---|
| Map personal data | Inventory of customers, staff, systems and recipients | High |
| Determine legal roles | Controller/processor responsibility map | High |
| Check NDPC classification | Written DCPMI assessment and registration decision | High |
| Identify lawful bases | Purpose and legal-basis register | High |
| Publish privacy notices | Accurate website and offline collection notices | High |
| Review cookies and marketing | Tracker audit, lawful consent/choice controls where required | High |
| Handle rights requests | Request channel, workflow and response log | High |
| Harden security | MFA, access reviews, backups, updates and testing | High |
| Manage vendors and transfers | Processor agreements and transfer assessment | Medium/High |
| Incident readiness | Risk triage and 72-hour notification escalation | High |
| Assess high-risk processing | DPIA where appropriate | Risk-based |
| Training and audit | Staff training, internal reviews, applicable CAR/renewal | Recurring |
Treat this as an editorial working checklist, not an NDPC-issued certificate. The Commission itself announced a November 2025 partnership to develop an SME checklist with Smartcomply, but that announcement does not mean a completed official checklist automatically certifies businesses. See the NDPC announcement .
14. A realistic 30-day implementation plan
| Period | Actions | Outcome |
|---|---|---|
| Week 1 | Inventory personal data, staff access, systems and suppliers | Data map and risk list |
| Week 2 | Check classification, lawful bases, notices and cookies | Legal-basis register and updated notices |
| Week 3 | Fix access, backups, third-party contracts and retention settings | Implemented safeguards and action log |
| Week 4 | Test rights requests, breach response, train staff and verify filings | Management review and continuing schedule |
A month is a practical starting period, not a statutory grace period. A high-risk clinic, fintech or large SaaS platform may need an earlier urgent assessment and specialist assistance. Keep an ongoing review calendar and document actual progress rather than claiming instant compliance.
15. What penalties can apply?
Under section 48 of the NDP Act, enforcement can include corrective orders, compensation, accounting for profits and penalties or remedial fees. For a data controller or processor of major importance, the higher maximum penalty is the greater of ₦10 million or 2% of its previous year's annual gross revenue. For one not of major importance, the standard maximum is the greater of ₦2 million or 2% of previous-year gross revenue. These are statutory maximum measures used in the Act, not automatic fines for every missing privacy notice.
The Commission must consider the gravity and duration of the infringement, impact on individuals, negligence, mitigation and cooperation. Businesses should therefore take documented remedial action and seek legal advice on any specific investigation. A small operation is not immune from the law merely because its turnover is low.
Frequently asked questions
Does the NDP Act apply to a small Nigerian online shop?
Generally, yes, when the shop processes personal data within the Act's scope. Whether it must register as a controller or processor of major importance depends on its category, data volumes, processing risks and current NDPC guidance.
Must every small business register with the NDPC in 2026?
No. Registration obligations apply to designated controllers and processors of major importance. The NDPC guidance identifies some small traders and artisans outside that category; assess the particular business rather than assume a universal registration obligation.
Is a privacy policy enough to make my business compliant?
No. A policy is only one component. The business must also meet the applicable lawful-basis, security, rights, vendor, retention, breach and accountability requirements.
Does every business have to file a Compliance Audit Return by 31 March?
No. The GAID specifies the formal annual CAR obligation for relevant UHL and EHL DCPMIs. OHL registration renewal and audit treatment can differ; check NDPC's current guidance.
How quickly must a business report a data breach?
A controller generally must notify the NDPC within 72 hours of awareness where the breach is likely to risk individuals' rights and freedoms; high-risk breaches require immediate communication to affected people under the Act's rules.
Conclusion
Nigeria data protection compliance in 2026 is not just a registration receipt or a privacy-policy footer. It begins with understanding which personal information a business uses and why, securing it, respecting customers' rights and preparing to respond when something goes wrong.
Small businesses should follow the NDP Act and GAID's core obligations while separately verifying whether they fall within NDPC's major-importance registration or CAR categories. The most defensible compliance checklist is one backed by real evidence: accurate data inventories, tested security, staff awareness, proper processor contracts and a record of decisions.
