Data Protection for Nigerian Websites: A Practical Guide for Businesses

Data Protection for Nigerian Websites: A Practical Guide for Businesses

Every time someone fills in your contact form, joins your newsletter, books an appointment or pays at your checkout, your website collects personal data. Add analytics, cookies, chat widgets and plugins, and it collects more, often without anyone in the business noticing.

In Nigeria, that comes with legal responsibility. The Nigeria Data Protection Act 2023 (NDPA) sets the rules, and the Nigeria Data Protection Commission (NDPC) enforces them.

The NDPC's General Application and Implementation Directive (GAID) 2025, issued on 20 March 2025 and effective from 19 September 2025, explains how the Act is applied and replaced the older NDPR 2019. The Act can also apply to organisations outside Nigeria that process the personal data of people in Nigeria.

Please note: This article is general information for website owners, not legal advice. Your obligations depend on your organisation, sector and the data you handle. Check the NDPC's guidance and speak to a qualified lawyer or a licensed Data Protection Compliance Organisation (DPCO) for your specific situation.

Key terms in plain language

10 practical steps for your website

1. Map the data your website collects

You can't protect what you haven't listed. Make a simple inventory of:

• Contact, enquiry, booking and registration forms

• Checkout and payment details

• Newsletter sign-ups

• Login accounts and profiles

• Cookies, analytics and advertising pixels

• Chat widgets and WhatsApp buttons

• Where each type of data is stored, and who can see it

2. Choose a lawful basis for each purpose

Consent is not the only reason you may process data. The GAID includes articles on lawful bases such as consent, contract, legal obligation and legitimate interest. For each purpose, note which one applies. For example, you may process a customer's address to deliver an order they placed (contract), but you need clear permission to send marketing messages (consent).

3. Publish a clear privacy notice

The Act requires you to give people information about how their data is used (section 27). A good privacy notice is written in plain language and explains:

• What you collect and why

• Your lawful basis

• Who you share data with

• How long you keep it

• The person's rights and how to use them

• Who to contact

Link it in your website footer and beside every form. Don't copy one from a foreign website. It must describe what your website actually does.

4. Handle consent and cookies properly

The GAID has a dedicated article on consent to cookies and other tracking tools. Common good practice includes:

• Showing a cookie banner with a real choice (accept, reject, manage)

• Not loading non-essential analytics or advertising trackers until the visitor agrees

• No pre-ticked boxes for marketing consent

• Recording when and how consent was given

• Making it as easy to withdraw consent as to give it. The Act covers withdrawal of consent (section 35).

5. Collect less

The less you collect, the less you have to protect.

• Ask only for what you need to deliver the service

• Don't request identity numbers unless there's a clear reason

• Take extra care with sensitive personal data, such as health details (section 30)

• If your website serves children, such as a school website, take extra care, because the Act has specific rules for children and people who can't give consent themselves (section 31)

6. Secure your forms and your website

The Act requires appropriate security, integrity and confidentiality (section 39). In practice:

• Use HTTPS on every page

• Keep your CMS, plugins and server software, including PHP, up to date

• Use strong passwords and multi-factor authentication

• Give staff access only to what their role requires

• Protect file uploads and limit who can see form submissions

• Don't send sensitive data in plain email

• Keep encrypted, tested backups

Our Website Security Checklist for Nigerian SMEs in 2026 covers these in detail.

7. Vet third parties and where your data is stored

Your hosting provider, email platform, analytics tool, payment gateway and form plugin may all handle personal data for you. The GAID includes an article on data processing agreements. For each one:

• Confirm what data they receive and why

• Have written terms that cover data protection

• Find out where the data is stored. The Act has rules for transfers outside Nigeria (sections 41 to 43), and the GAID adds guidance on cross-border transfers.

8. Decide how long you keep data, and delete it

Data shouldn't live forever. Set a retention period for each type: old enquiries, expired accounts, unused files, inactive newsletter subscribers. Delete on schedule, and remember that copies may also sit in backups and email inboxes.

9. Be ready for people's requests

The NDPC lists the rights people have over their data: to be informed, to access it, to correct it, to object, to restrict processing, to move it (portability), to have it erased, and not to be subject to automated decisions. Make it easy to exercise them:

• Publish a privacy contact address

• Assign someone to respond

• Verify identity before releasing data

• Keep a log of requests and responses

10. Prepare for a breach before it happens

A personal data breach includes ransomware, a hacked email account, a lost laptop and a message sent to the wrong person. If a breach is likely to put people at risk, you must notify the NDPC within 72 hours of becoming aware of it, and tell affected individuals promptly where the risk is high. Even incidents you don't need to report should be documented.

Prepare now:

• A named response team and contact list

• A simple process to assess severity

• Template messages to the NDPC and to affected people

• A breach register

• Backups you've actually tested

Do you need to register with the NDPC?

Not every organisation does, but many are close to the line. The GAID sets out categories of "data controllers and processors of major importance", with a base threshold that starts at around 200 people whose data you process in a six-month period, and certain sectors must register regardless of volume. Higher tiers must also appoint a data protection officer and file annual compliance audit returns through a licensed DPCO.

Even if you don't have to register, you are not exempt from the Act's basic duties. Check your position on the NDPC's website or with a licensed DPCO.

What's at stake

Penalties for organisations of major importance can reach up to ₦10 million or 2% of annual gross revenue, whichever is higher. Enforcement is not theoretical: the NDPC has fined well-known organisations in recent years. The regulator is also paying attention to websites. It has set privacy benchmarks for public sector websites.

But the bigger cost for most businesses is trust. Customers who feel their data was mishandled rarely come back.

Common mistakes to avoid

❌ Copying a privacy policy from a foreign site

❌ Loading trackers before visitors consent

❌ Using pre-ticked marketing boxes

❌ Collecting data "just in case"

❌ Leaving old form submissions in an inbox forever

❌ Installing plugins nobody has reviewed

❌ Having no one responsible for privacy requests

❌ Assuming a small business is exempt

Website data protection checklist

✅ I know what personal data my website collects

✅ Each purpose has a lawful basis

✅ A plain-language privacy notice is linked from every page and form

✅ Cookies and trackers respect visitor choices

✅ Forms ask only for what's needed

✅ HTTPS, updates, strong access controls and tested backups are in place

✅ Third parties and data storage locations are reviewed

✅ Retention periods are set and followed

✅ Someone owns data requests

✅ A breach response plan exists

✅ I've checked whether I must register with the NDPC

How Digitalbes Limited can help

We are a web design and development company, not a law firm. We handle the technical side of compliance, and your lawyer or DPCO advises on the legal side.

We can help with:

• Website data audits: finding the forms, trackers and plugins that collect personal data

• Privacy notice and consent implementation: placing your approved notice and building cookie consent that works

• Secure forms and portals: minimal data collection, protected uploads and role-based access

• Hosting, backups and security: patched servers, encrypted backups and monitoring

• Website maintenance: ongoing updates so vulnerabilities don't linger

Final thoughts

Data protection isn't a document you publish once. It's a set of habits: collect less, explain clearly, protect carefully, delete on time and respond quickly when something goes wrong.

Done well, it protects more than your legal position. It shows customers that their information is safe with you.

Sources and further reading

• Nigeria Data Protection Commission (NDPC)

• NDP Act GAID 2025 (NDPC)

• Nigeria Data Protection Act 2023 (full text)

Do you know what personal data your website collects?

Request a free website data protection review from
Digitalbes Limited.

📩 www.digitalbes.com/

Bringing Your Ideas to Digital Life