An Overview of The Nigeria Data Protection Act
On June 12, 2023, the Nigerian government took a bold step towards achieving maximum data protection. The country enacted the Nigeria Data Protection Act to provide a comprehensive legal framework for data protection. While the European Union (EU) was miles ahead, this decision placed Nigeria on the same journey towards the protection of data. Prior to this, the Nigerian government made several attempts to protect personal data, one of which is the NDPR The NDPR, which stands for Nigerian Data Protection Regulation, was issued in February 2019 and established by the NITDA (Nigerian Information Technology Development Agency). But there wasn’t much regard for it. Why? A major shortcoming of the NDPR is that it’s subsidiary legislation and lacks vital provisions expected of a comprehensive law. For example, NITDA lacked the statutory authority to establish a commission with wide powers to deal with data privacy issues in Nigeria. This created a problem between foreign organisations and the Nigerian market, as the former could not trust the latter. So, the NDPA came into play as the principal data legislation in Nigeria. This article will provide an overview of the NDPA, its objectives, basic terminology, scope of application, principles, and penalties. Objectives of the Nigerian Data Protection Act (NDPA) There’s something about data that’s invaluable. A look at the estimated amount of data generated worldwide—2.5 quintillion bytes—proves how much the world uses data. While individuals can pretend to not need data, companies dare not say so. They need data to run promotions, for market expansions, product diversification and most importantly, digital marketing Now, companies are not the only users of data; cybercriminals obsess over it too. And they don’t care about who/what gets hurt. So, Organizations have to implement data protection systems against unauthorized access, loss, or compromise of data. So, how does the NDPA help out? The primary objective of the NDPA is to safeguard the fundamental rights and freedom of privacy as guaranteed under the constitution of the Federal Republic of Nigeria. The objectives of the NDPA in detail are: To protect the rights of data subjects by making sure personal data is processed in a lawful, fair, and transparent manner. This aligns with the basic principles of data protection. To provide a legal framework for the regulation and protection of personal data. Also a means of rectifying the rights of data subjects breached. To ensure data controllers and processors comply with their obligations to data subjects To promote data security and privacy in data processing activities in Nigeria. To ensure the inclusion of Nigeria in the regional and global economies through trusted use of personal data. Basic terminologies in NDPA. The Nigerian Data Protection Act has unique terminology. Here are some definitions to help you get started. Data controller Is an individual, private entity, public commission, agency, or any other body that, alone or jointly with others, determines the purpose and means of processing data. Data Processor The act describes a data processor as an individual, private entity, public authority, or any other body who processes data on behalf of a data controller or another data processor. Personal data Any information that relates directly or indirectly to an identified or identifiable individual by reference to an identifier, e.g., name, age, identity number, location ID, factors specific to the physical, psychological, cultural, social, or economic state of the individual. Sensitive personal data The act defined sensitive data as personal data relating to an individual’s Genetic and biometric data Ethnic origin Religious or similar beliefs, such as philosophy or conscience,. Sex life Health status Political opinion Trade union membership And other information deemed sensitive by the commission. Scope and Application of the Nigerian Data Protection Act The NDPA applies to the processing of personal data by data controllers and processors belonging to data subjects in Nigeria. The NDPA mandatorily applies in the following instances: Where the data processing takes place is Nigeria. The organisation processing data is not located in the country but processes data belonging to a Nigerian citizen. The data controller or processor is resident, domiciled, or operating in Nigeria. It’s important to note that the location of the controller or processor doesn’t matter as long as the data subject is in Nigeria; the NDPA applies. However, the Nigeria Data Protection Act has limitations. The Nigerian Data Protection Act does not apply to the processing of personal data carried out by one or more persons solely for personal or household purposes. Also, it’s important to know that this exemption applies when such processing doesn’t violate the fundamental rights of a data subject. Additionally, the NDPA will not apply if the processing of personal data is carried out by a competent authority for any of the following purposes: the prevention, investigation, detection, prosecution, or adjudication of a criminal offense or to execute a criminal penalty in accordance with any applicable law; to prevent or control a national public health emergency; for national security; in respect of publication in the public interest for journalism, educational, artistic and literary purposes to the extent that such obligations and rights are incompatible with such purposes; or necessary to establish, exercise, or defend legal claims, whether in court proceedings or in an administrative or out-of-court procedure Basic Principles of the Nigerian Data Protection Act (NDPA) Just like most data protection regulations around the world, the NDPA has principles guiding organisations to compliance. Consent Organisations must get the full consent of the data subjects before collecting, processing, and storing data. The subjects must give consent freely with no trace of foul play. The data subjects also have the right to withdraw their consent. Now, data processing is lawful without consent when carried out: To protect the interests of the data subject or another person, where the subject is physically or legally incapable of giving consent. To establish, defend a legal claim, get legal advice, or carry out a legal proceeding. To carry out a contract to which the data subject is a third party. To conduct a task of public interest.
Data Protection Officer: Why You Need One As a SME in Nigeria
As a small to medium-sized enterprise (SME) in Nigeria, running a business in this economy is tough. Every naira counts, and every decision feels like a tightrope walk. Between managing staff and staying ahead of the competition, there’s so much to juggle. But here’s the thing: a hidden threat beneath the surface is a data breach waiting to happen. Data breaches are real, and small businesses are easy to target. So what can you do? That’s where a data protection officer comes in. A DPO helps your business follow the regulations stated in the data protection bill. What is a Data Protection officer? A data protection officer ensures an organization follows data protection laws and regulations. An example of this regulation is the NDPR or GDPR. These regulations help protect customers’ personal information from data breaches. What is The Role of a Data Protection Officer in Business? Below are a few things a data protection officer does: DPOs provide advice on how to complete data protection impact assessments. Data protection is a process that helps identify and manage risks They help to carry out assessments to ensure that all workers stick to NDPC DPOs ensure that they take a risk-based approach whenever a suspected breach occurs. Benefits of Having A DPO As A SME in Nigeria A report by Techcabal shows that Nigeria experienced a 64% increase in data breach in 2023. This is higher compared to 2022. With this increase, it’s clearly obvious that Nigerian businesses need a DPO to help protect individuals’ data. Here are some benefits of having a data protection officer in your organization: Data Breaches Can Wreck Your Business If hackers steal your customer info, it’s a big problem. Your company could face fines, and you could lose customers. When this occurs, it might take ages to fix your reputation. Furthermore, data breaches can spread like wildfire online. At the end, your business will be hurt badly. DPOs Make Data Security Easy A DPO helps you build a shield around your customer information. They create clear rules on handling data, train your staff on what to do, and check for weaknesses in your system. This keeps your data safe and saves you time and money in the long run. DPOs Help You Work Smarter Having a lot of customer information can be both helpful and confusing. A DPO helps you organize it all, making it easier to find what you need. This saves time and reduces the chance of mistakes that could lead to a data breach. DPOs Make You More Trustworthy Statistics show that 62% of people are more likely to do business with someone they trust. These days, people worry about who has their information. Having a DPO shows customers you take their privacy seriously. That can give you a leg up on the competition. Does My Business Need A Data Protection Officer Under NDPC? Knowing if you need a DPO as a business under NDPC depends on the nature of your data processing activity. Below is a breakdown of the key factors to consider: 1. Mandatory DPO Appointment The NDPC states that any organization that falls under any of these categories needs to have a DPO: If you’re a public authority, for example, a government body. This doesn’t include courts Your business regularly tracks a large amount of customer data If your business handles special data like health information or religious beliefs 2. Voluntary DPO Appointment Even if not mandatory, appointing a DPO is good practice if: Your business processes a significant amount of personal data. Especially for marketing or profiling purposes. Your business deals with a high volume of data subject requests e.g., access requests. You operate in an industry with a high risk of data breaches (e.g., finance, healthcare). Requirements For Appointing a Data Protection Officer Under NDPC If you’re an organization in Nigeria under NDPC , you aren’t allowed to just appoint anyone as your DPO. There are some requirements to be met before choosing a DPO. Here are some of them: For the registration of your DPO, you’ll have to submit the individual’s name and data privacy requirements. This is in line with section 32(1) of the Nigerian Data Protection Act. This section states, “Data controllers handling significant amounts of data must appoint a DPO with expertise in data protection law.” The DPO must have expertise in Nigerian data protection laws and practices. The DPO must have an in-depth understanding of applicable data protection laws. Why Do SMEs Need A Data Protection Officer? As a Small and Medium-sized Enterprise (SME) in Nigeria, you may think that data protection is only a concern for large corporations. However, as businesses increasingly rely on digital tools, SMEs face growing risks of cyberattacks. Here are some reasons why SMEs in Nigeria need a Data Protection Officer: 1. Protection of Sensitive Customer Data As an SME, you likely collect personal data from your customers, such as names, addresses, phone numbers, and financial information. A Data Protection Officer can ensure that this data is properly secured and protected from unauthorized access, theft, or loss. 2. Compliance With Data Protection Regulations Nigeria’s data protection regulations require businesses to appoint a DPO. This is to help oversee data protection practices. A DPO can help your business follow these regulations, avoiding costly fines and reputational damage. 3. Building Trust With Customers and Stakeholders You demonstrate your commitment to data protection and privacy by appointing a Data Protection Officer. This can help build trust with your customers, stakeholders, and business partners. With this, your reputation and competitiveness are enhanced. 4. Mitigating Cyber Security Risks A Data protection officer can help identify and mitigate cyber security risks. This helps to reduce the likelihood of data breaches and cyber-attacks. This is particularly important for SMEs, which may not have the resources to recover from a major data breach. 5. Staying Ahead of The Competition You can differentiate your business from competitors by prioritizing data protection and appointing a Data
Data Protection Impact Assessments: Why You Need One
With advancements in tech, the process of collecting, and storing data was expected to be smooth. Unfortunately, the use of the internet for data collection and transfers exposes it to more threats. The owners of the data collected are now vulnerable, as their data can suffer accidental loss or compromise. In the wrong hands, sensitive data can be destructive e.g. impersonation, targeted attacks, and the likes. What do organizations do then? They devise means of data protection, guided by data protection laws around the world. As a precautionary method, data controllers (entities that collect and determine the purpose of data processing) are required to carry out a data protection impact assessment. What is a Data Protection Impact Assessment (DPIA)? Data Protection Impact Assessment is the process of determining the level of risks involved with collecting personal data for a project. All projects come with risks, as long as data is involved. The main issue is how prepared data controllers are to contain the risks. Given that it is impossible to fight an unknown enemy, the purpose of a DPIA is made more obvious. A Data Protection Impact Assessment will identify the risks and also find ways to reduce the impact. The Importance of A Data Protection Impact Assessment Organizations stand to lose everything unless they perform DPIA. Think about it: no one would keep money in a bank prone to robberies. The same principle applies in this case. Clients trust organizations to keep their data safe. Regular data loss or compromise will do enough damage to shut down a company. A DPIA ensures data controllers are aware of risks to data and ready to curtail them. Threats to organizations’ reputations are thus averted. Besides that, organizations can avoid penalties of data protection laws around the world. The GDPR, for example, deems a DPIA necessary under certain circumstances. So, carrying out a Data Protection Impact Assessment is important to achieve GDPR- compliance. When is a DPIA Required? According to the Nigeria Data Protection Regulation (NDPR), it is necessary in situations where they process highly sensitive data. Sensitive data under the NDPR refers to personal data relating to an individual’s: And others, as determined by Section 30(2) of the NDPR. A DPIA is required when the data handled belongs to sensitive or differently-abled subjects. Systematic monitoring, large-scale profiling, automated decision-making with legal effects, and the application of new technological solutions are some of the situations that need a DPIA. On the flipside, data protection impact assessment is not required where data processing is not likely to result in high risk to rights and freedoms of persons. Honestly, organizations should carry out a DPIA when handling a new project. To be on the safe side. Who Should Be Included in DPIA? The controller is 100% responsible for carrying out a DPIA. Other groups are involved in the process, but the data controller is held most accountable Now, the data controller may choose to outsource the process to a third party. Especially when the organization lacks the expertise, experience, or personnel to conduct it. A project deemed risky may also warrant the use of a data protection service consultancy. Since the process is likely to affect several aspects of a project, it is necessary to involve engineers, developers, and designers. They will be able to shed more light on the DPIA process. The data protection impact assessment should be carried out with the utmost care. This requires a team of professionals well-versed in the DPIA process. Whether overseen internally by the organization or outsourced to a consultancy, the GDPR and the Data Protection Bill mandate the appointment of a Data Protection Officer (DPO). Who is a DPO? A Data Protection Officer is a person overseeing the process of a Data Protection Impact Assessment. A DPO can be outsourced by a data protection service consultancy, if an organization lacks the personnel for it. Lastly, data subjects must be involved when carrying out a DPIA. This will show transparency while taking the concerns of the subjects into consideration. How To Do a DPIA Conducting a data protection impact assessment is serious business. Doing it the wrong way can cost an organization valuable time and money. To make the process simpler, here is a DPIA template you can follow. Step 1: Identify The Need. It will be futile to carry out a Data Protection Impact Assessment where it is not important. Below are some questions to determine if it’s necessary. Step 2: Context If you answered yes to any of the above questions, then you can move on to this step. Here, you have to be clear and specific. Be as detailed as possible. Step 3: Describe the Flow of Information. For extra clarity, make use of a flow diagram. Step 4: Identify and Assess the Privacy Risks. Make a list of the identified risks, their impacts, and the likelihood of their occurrence. Step 5: Make a Risk-reduction Plan. Once the risks have been identified, the next is to create a counterplan. How do you intend to curtail the effect of each of the risks? Document your plans, leaving no stone unturned. The expected result of the counterplan should also be documented. Step 6: Delegation Assign a part of the process to several personnel for greatest effectiveness. Record who oversees what and the stipulated time frame for the activity. Step 7: Reassess the Entire System. Double-check all the identified risks, impacts, and likelihoods against the control methods. This will cut all loopholes. These 7 steps are enough to get an idea of how to conduct a Data Protection Impact Assessment. DPIA vs. PIA The Data Protection Impact Assessment and Privacy Impact Assessment (PIA) are tools that organization use to estimate privacy risks to personal data in projects. While the former is a specific and mandatory requirement of the GDPR, any organization can use PIA to assess the privacy impacts of their activities. DPIA is legally necessary in certain cases within the EU, while PIA is the best data protection practice and privacy compliance globally. Conclusion In compliance with data
How to Choose the Right Data Protection Service Consultancy In Nigeria
is a necessity for every functioning organization. While it is important, most organisations need assistance in the form of data protection service consultancy. In this article, you will learn what a data protection service consultancy is, its needs, the services, and how to choose the right consultancy. What is a Data Protection Service Consultancy? It’s a service that provides organisations with expert advice on how to protect sensitive data from loss, compromise, or unauthorised access. Data protection service consultancy includes a general assessment of the existing system. It is compliance with data protection regulations and the identification of potential data breaches. Also, data protection practices are implemented. This service may also include employee training on safeguarding data. What is the Need for Data Protection Service Consultancy? Data collection, processing, and use form the core of every organisation, small or large. In recent times, there has been a rise in ransomware and phishing attacks on companies’ databases. Hence, the need to protect data from such threats, mishandling, and loss. Due to the importance of data protection, several laws and regulations have been established. These guide businesses on how to protect the sensitive information of their clients, making the process more complex. On one hand, organisations need data protection; on the other, they do not know how. This is where data protection service consultancy comes in. At a cost, organisations can have their entire data security system appraised and updated by agencies well-versed in the area. Services Covered by Data Protection Consultancy 1. Data Protection Audits This is the process that takes a critical look at the data protection practices of an organisation to determine its effectiveness. Data Protection Audits are important for businesses to identify inadequacies in their protection systems. Are data protection audits compulsory? Yes, they are. As a matter of fact, the ICO (Information Commissioner Office) has the power to carry out compulsory audits of organisations according to S146 of the Data Protection Act, 2018. So, if you know anything about protecting data, you might want to have an audit as soon as possible. 2. Data Protection Impact Assessment (DPIA) Data protection impact assessment is a process that helps identify and reduce the data protection risks associated with a project. DPIA is carried out when a project is large, deals with personal data, or processes the data of sensitive individuals. Resource: Why You Need A DPIA A data protection service consultant will determine the risk and provide a solid plan on how to reduce it to the smallest. Not sure if you need a DPIA? Check the ISO checklist. 3. Data Protection Training Data protection training is an important part of data protection service consultancy, where staff and stakeholders of organisations are educated on the laws and best practices in data protection. The scope of data protection training largely depends on what the business needs.For example, a company unable to follow GDPR will undergo GDPR compliance training. It is also important that data protection training be conducted at reasonable intervals. 4. GDPR Compliance The General Data Protection Regulation (GDPR) is a set of rules made to protect the data of European Union (EU) citizens. The consequences of non-compliance with these rules can be dire—up to 4% of annual global turnover, or €20 million. As part of the activities covered, a consultancy will check your organisation’s data protection system for inadequacies and offer help to ensure it becomes GDPR compliant. 5. Outsourced Data Protection Officer (DPO) Data protection consultancies also help organisations with compliance and data protection regulations like the GDPR by assigning a professional well-versed in the laws and practices of data safety. Outsourced DPO services are beneficial to small businesses, especially. Since they don’t have the internal resources to fulfil the role. Resource: Why You Need a DPO Another benefit of this service is that businesses can avoid the extra cost of hiring a full-time employee. Also, they gain full access to expert guidance at the same time. The roles of a DPO include: Monitoring Compliance: Ensures the organization adheres to data protection laws and policies. Advising on Legal Obligations: Provides guidance on compliance with data protection regulations. Risk Assessment: Identifies and mitigates data protection risks in organizational processes. Conducting Audits: Evaluates internal practices to ensure alignment with data protection standards. Liaison with Authorities: Acts as the point of contact for supervisory authorities like data protection regulators. Employee Training: Educates staff about their responsibilities regarding data protection. Data Protection Impact Assessments (DPIAs): Oversees and advises on DPIAs to evaluate the impact of processing activities on data protection. Handling Data Breaches: Manages and reports data breaches as required by law. Fostering Data Privacy Culture: Promotes awareness of data protection principles across the organization. 6. Data Localization Data localisation is the act of keeping data in the region it originated from. For example, if an organisation gets data from Nigeria, they store the data in Nigeria. In times when data can be transferred over the internet at lightning speed, the movement of data and its use have the interest of all data protection stakeholders. Consultancies help businesses localise data by offering data centres or cloud services that have data centres in the required locations. This data protection service reduces the cost of setting up several data centres from scratch for businesses operating in many countries and offers premium data protection. 7. Data Breach Management Many enterprises fall victim to data breaches once in a while. What is more important is how it is managed. Data protection consultancies offer this service to help organisations overcome such occurrences by creating and initiating an incident response plan, assembling an incident response team, and sending public notifications. 8. Data Digitization Data digitisation is the process of converting analogue information to digital format. Organisations handling significant amounts of sensitive data must use this service. These include financial institutions, legal practices, and medical facilities. The digitisation of data makes it easier for them to protect the personal data of their clients. How to Choose the Right Data Protection Service Consultancy When it comes to data protection, one size does not fit all. For that, selecting the right consultancy is
What to Know About Data Protection and Data Protection Principles
Understand data protection and its importance, know the best practices and regulations including top trends in the world of data protection
