What NDPR means for your website and customer data

Nigeria's data protection rules apply to any business that collects names, emails or phone numbers. In practice, publish a clear privacy policy, get consent before marketing emails or WhatsApp messages, secure data with encryption, access controls and backups, collect only what you need, and have a plan for responding to a data breach.

Nigeria’s data protection framework sets out how businesses must collect, store and use personal data. If you collect names, emails or phone numbers, it applies to you.

Practical steps

1. Publish a clear privacy policy explaining what you collect and why.
2. Get consent before marketing emails or WhatsApp messages.
3. Secure your data with encryption, access controls and backups.
4. Collect only what you need and delete what you no longer use.
5. Have a breach plan so you can respond and notify quickly.