Nigeria's Data Protection Act 2023: What Tech Companies Need to Know

Nigeria passed the Data Protection Act (NDPA) in 2023, and the Nigeria Data Protection Commission (NDPC) is actively enforcing it. If you're building technology that processes personal data of Nigerian residents, this applies to you. Most coverage of the NDPA is written for lawyers. Here's the developer-relevant version. Who it applies to Any organisation processing personal data of Nigerian residents. This includes: Nigerian fintechs and startups (obviously) International SaaS platforms with Nigerian users Any app available in Nigeria that collects user data Companies using AI APIs that process Nigerian customer queries Key requirements Lawful basis — you need a legal reason for every piece of personal data you process. Contract performance (providing the service they signed up for) covers most app functionality. Privacy notices — tell users what data you collect, why, how long you keep it, and their rights. DPIAs — Data Protection Impact Assessments for high-risk processing. AI syste