NDPA 2023: What Every Nigerian Business Website Must Do About Customer Data

If your business website collects a name, a phone number, an email address, or a delivery address, you are handling personal data — and since June 2023, a Nigerian law tells you exactly how you must handle it.

The Nigeria Data Protection Act (NDPA 2023) was signed into law on 12 June 2023. It replaced the older Nigeria Data Protection Regulation of 2019 and created a dedicated regulator, the Nigeria Data Protection Commission (NDPC). It applies to any organisation that processes the personal data of people in Nigeria — including your online store, your booking form, and your WhatsApp business account.

What Counts as Personal Data?

Personal data is any information that relates to an identified or identifiable person. On a typical Nigerian business website, that includes names, phone numbers, and email addresses from contact and order forms; delivery addresses; payment details, even when processed through a payment gateway; account details if customers create accounts; and location or device information collected by analytics tools.

If your website collects any of these, the NDPA applies to you. It does not matter whether you are a one-person business or a company with fifty staff. The law cares about the data, not the size of your business.

The Principles Your Website Must Follow

The NDPA is built on principles that govern how personal data must be handled. You do not need to memorise the legal wording, but your website should live by these ideas: be lawful, fair, and transparent — have a valid reason to collect data and tell people what you collect and why. Collect data only for the purpose you stated; if a customer gives you their phone number for a delivery, do not automatically add them to a marketing list. Collect only what you need, keep it accurate, and do not keep it longer than necessary. And protect what you hold with reasonable security, so it is not lost, stolen, or exposed.

What the Fines Actually Are

The NDPA sets a tiered penalty system, and the figures are worth stating carefully because they come directly from the Act itself. For data controllers and processors of major importance — large platforms, financial institutions, telecom operators, and organisations handling significant volumes of personal data — the NDPC can impose a fine of up to ₦10 million or 2% of annual gross revenue from the preceding year, whichever is higher. For all other data controllers and processors, the fine is up to ₦2 million or 2% of annual gross revenue, whichever is higher.

Note the words "whichever is higher." For a large company, 2% of annual revenue can be far more than ₦10 million. The NDPC has already shown it will use its powers: in July 2025 it fined Multichoice Nigeria ₦766.2 million for intrusive processing of subscriber data and unauthorised transfer of personal data out of the country, and in February 2025 it fined Meta Platforms $32.8 million over behavioural advertising. There are also criminal penalties for wilful violations, including the possibility of imprisonment for responsible officers.

Most small businesses will never face a fine of that scale, but the lower tier is still a serious amount — and an NDPC investigation or a customer complaint can damage trust that took years to build.

What Your Website Must Do: A Practical Checklist

1. Publish a clear privacy policy

Every business website that collects personal data needs a privacy policy, written in plain language, that explains what data you collect, why you collect it, how long you keep it, who you share it with (for example, your delivery company or payment processor), what rights customers have, and how they can contact you about their data. Link it in your website footer and on every page where you collect data.

2. Get real consent before collecting data

Consent must be freely given, specific, and informed. Your newsletter signup should have a clear checkbox or statement explaining that the person is agreeing to receive marketing emails — do not pre-tick the box. Your forms should explain what the information will be used for. And if you use cookies or tracking tools, your website should show a cookie notice that lets visitors accept or decline non-essential tracking. If someone asks to stop receiving your messages, you must stop, promptly.

3. Secure your website

Security is a legal duty under the NDPA, not just good practice. Use HTTPS on every page, keep your website software and plugins updated, use strong passwords and two-factor authentication for your admin area, limit who on your team can access customer data, and make regular backups stored securely.

4. Know who processes data on your behalf

Most websites rely on third parties: a payment gateway like Paystack or Flutterwave, a delivery company, an email marketing tool, a hosting provider, or Google Analytics. Under the NDPA, you are responsible for making sure these processors handle data properly too. Choose reputable providers, and be careful with data leaving Nigeria — the NDPA places conditions on cross-border transfers.

5. Have a plan for data breaches

If customer data is exposed — through a hack, a lost device, or an email sent to the wrong person — the NDPA expects you to act. The law requires breach notification to the NDPC within 72 hours in many cases, and affected customers may need to be informed too. You need a simple written plan: who to call, how to secure the problem, what to tell the NDPC, and what to tell affected customers.

6. Respect customer rights, and check whether you must register

Under the NDPA, customers can ask to see what data you hold about them, ask you to correct it, ask you to delete it, and object to how you use it. A contact email or a simple form is enough for most small businesses — what matters is that requests are answered, not ignored. The NDPC also requires certain organisations, particularly those of major importance, to register as data controllers or processors — see the NDPC's General Application and Implementation Directive (GAID) 2025, or check ndpc.gov.ng if you are unsure whether registration applies to you.

How Compliance Builds Trust (and Sales)

Customers in Nigeria are increasingly aware of data misuse — unwanted marketing, data leaks, and scams that start with a leaked phone number. A business that visibly protects customer data stands out, and that trust converts into repeat orders and referrals.

If you would like a deeper look at the legal documents a business website needs, our guide on AI legal documents, contracts and privacy policies is a useful companion to this article.

Frequently Asked Questions

Does the NDPA apply to my small business or only to big companies?

It applies to any organisation that processes the personal data of people in Nigeria, regardless of size. The fine tiers differ, but the core duties around consent, transparency, security, and customer rights apply to everyone.

Do I need a privacy policy if I only collect data through WhatsApp?

Yes. The NDPA covers personal data however you collect it — through a website form, WhatsApp, Instagram DMs, or a paper form at your shop. A privacy policy on your website is the simplest way to explain what you do with customer details.

What is the difference between the NDPA and the old NDPR?

The NDPR of 2019 was a regulation issued by NITDA. The NDPA of 2023 is a full Act of the National Assembly, which gives it stronger legal standing. It also created the NDPC as an independent regulator, replacing NITDA's former role. The NDPR no longer applies — the GAID 2025 ended its application from September 2025.

I use Paystack and Google Analytics. Am I still responsible for the data?

Yes. Using a reputable payment gateway or analytics tool does not remove your responsibility. You remain the data controller for the data you collect, and you must make sure the tools you use handle it properly.

Start With the Three Easiest Fixes

Start with three things this week: publish a plain-language privacy policy and link it in your footer, add a clear consent statement to your forms and newsletter signup, and make sure your website runs on HTTPS with updated software. Then work through the rest of the checklist one item at a time — compliance is a habit, not a one-day project.

If you need help updating your website — a privacy policy page, a secure contact form, HTTPS setup, or a cookie notice that actually works — explore our services and contact us. We build websites for Nigerian businesses that are properly set up for the rules governing customer data.

This article is general information based on the NDPA 2023 and GAID 2025 as published at the time of writing. It is not legal advice. For specific legal questions about your business, speak to a qualified Nigerian data protection lawyer.