Introduction
Nigeria’s digital economy is growing rapidly, and Small and Medium Enterprises (SMEs) are driving much of that growth by using personal data to enhance their operations. Whether through maintaining customer databases or analysing consumer behaviour, data has become a valuable business resource.
The Nigeria Data Protection Act (NDPA), 2023, grounded in the constitutional right to privacy under Section 37 of the 1999 Constitution (as amended), now provides the legal framework for how this data must be handled.
For SMEs, compliance is not a best practice but a legal duty. The General Application and Implementation Directive (GAID) 2025, issued by the Nigeria Data Protection Commission (NDPC), provides further guidance and lowers the threshold for classification as a “Data Controller of Major Importance.” This means that a larger number of SMEs now fall within the Commission’s regulatory oversight.
This article simplifies the NDPA’s key provisions into clear, actionable steps that can help your business meet its obligations, avoid penalties under Part X of the NDPA, and strengthen public trust.
Phase 1: Conduct a Compliance Assessment
Before introducing any control measures, determine your business’s legal status under the NDPA.
1. Are you a Controller or a Processor?
Most SMEs will qualify as Data Controllers (Section 65, NDPA) because they decide why and how personal data is processed, such as collecting customer details to complete a delivery. If you only process data on behalf of another organisation without decision-making authority, you are a Data Processor.
2. Are you of “Major Importance”?
The NDPA (Section 44), clarified by GAID 2025 (Article 8 and Schedule 7), classifies any organisation that processes the personal data of more than 200 individuals within six months as a Data Controller or Processor of Major Importance (Ordinary High Level – OHL).
What this means: Once you cross this threshold, additional legal obligations apply, including mandatory registration with the NDPC and payment of the applicable fees.
Phase 2: Core Compliance Steps for SMEs
Once your status is clear, implement the following five core compliance elements across your operations.
A. Governance and Lawful Processing
Under Section 25 of the NDPA, every data processing activity must have a lawful basis. Acceptable bases include:
Action Point: Review all data collection channels and record the lawful basis for each processing activity.
B. Transparency
Transparency is a legal requirement. Under Section 27 of the NDPA, individuals must be informed of how their data will be used before it is collected. A well-drafted and accessible Privacy Policy is essential.
For SMEs that operate websites, Article 19 of the GAID 2025 also requires clear cookie management. You must provide a visible cookie banner that allows users to accept or decline non-essential cookies.
Action Point: Review your privacy policy for clarity and update your website to include a compliant cookie consent tool.
C. Data Security
The duty to secure personal data is set out in Sections 24(3) and 39 of the NDPA. Security measures must be both technical and organisational. This means going beyond antivirus software to include encryption, limited staff access, and employee training.
Action Point: Implement basic security controls, such as restricted access to sensitive files and encryption of personal data, and provide regular data protection training to staff.
D. Data Subject Rights
Under Part VI of the NDPA, individuals (data subjects) have several rights, including the right to access their data, request corrections, and demand erasure when data is no longer necessary.
Action Point: Create an internal process for handling data subject requests and ensure your team can respond within statutory deadlines.
E. Third-Party Risk Management
Many SMEs rely on external vendors for services like storage, payments, or email systems. Under Section 29 of the NDPA, you remain responsible for how these vendors handle your customers’ data. You must have a written Data Processing Agreement (DPA) that commits them to NDPA standards.
Action Point: Review all vendor agreements and include NDPA-compliant data protection clauses where necessary.
Phase 3: Additional Requirements for Designated SMEs
If your SME meets the criteria for a Data Controller or Processor of Major Importance, additional obligations apply. These include:
Conclusion
Non-compliance with the NDPA carries serious business consequences. The NDPC can issue compliance orders and impose administrative fines that may run into tens of millions of Naira (Section 48, NDPA).
For Nigerian SMEs, managing personal data responsibly is now a legal and commercial necessity. Engaging a licensed Data Protection Compliance Organisation (DPCO) to perform an initial compliance audit and guide your implementation efforts can provide lasting protection and peace of mind.
Abdulkadir Muhammad, Esq.
Evens Solicitors, Abuja
For information only; does not constitute legal advice. Consult Evens Solicitors for specific guidance.