A founder, a spreadsheet and a law
A founder in Lagos runs a lending app. She holds names, phone numbers, BVN related details, transaction history and, because the app asks, a location. A customer emails to ask what data she holds and why. She has no clear answer, and she suspects that is a problem.
It is. This piece is a practical reading of the Nigeria Data Protection Act 2023 for startups. It is not legal advice, and you should take advice from a qualified Nigerian lawyer for your own case. It is meant to help you ask better questions.
The shape of the law
The Nigeria Data Protection Act 2023 sets out how personal data of individuals must be handled, and it created the Nigeria Data Protection Commission as the regulator. Before it, the Nigeria Data Protection Regulation of 2019 filled much of the same ground. The Act places the framework in primary legislation.
The vocabulary will be familiar if you know GDPR, which influenced it. A data controller decides why and how personal data is processed. A data processor handles it on the controller's behalf. A data subject is the person the data is about. Most startups are controllers for their own customers, and processors when they build for someone else.
The ideas that matter most
Lawful basis. You need a legitimate reason to process personal data. The Act lists several, including consent, performance of a contract, a legal obligation and legitimate interests. Consent is the one startups reach for first, and it is often the weakest, because it must be freely given, specific and withdrawable. If you need the data to deliver the service, contract is often the cleaner basis.
Purpose limitation and minimisation. Collect what you need for a stated purpose, and use it for that purpose. The location you collected for fraud checks is not automatically available for marketing. If you cannot say why you hold a field, that field is a liability.
Sensitive data. Categories such as health, biometrics, religious belief and similar get higher protection. Fintech and health startups handle this more often than they notice. A face scan for identity checks is biometric data.
Rights of data subjects. People can ask what you hold, ask for corrections, object to certain uses, and in some cases ask for deletion. You need a way to receive these requests and a habit of answering them, within the time the law allows.
Security and breach. You must protect the data with suitable technical and organisational measures. If a breach puts people at risk, the Act expects you to notify the Commission within a short window and, in some cases, the people affected. Check the current timing in the Act and any directions the Commission issues, because details can change.
Cross border transfers. Sending data abroad, including to a cloud provider hosted elsewhere, comes with conditions, such as adequate protection in the destination or appropriate safeguards. Many startups transfer data every day without having looked.
Registration and compliance. Organisations classed as data controllers or processors of major importance have additional duties, including registration with the Commission and, in some cases, audit filings and a data protection officer. Whether you fall into that class depends on factors set by the Commission, and you should check the current guidance.
A short working list
Here is what we would do in the first month, in order of return on effort.
- Make a data inventory: what you collect, where it sits, who sees it, why you have it.
- Write a plain privacy notice that matches what you actually do.
- Name a person responsible for data protection, even if it is not their only job.
- Create a route for access and deletion requests, and test it with one real case.
- List every vendor that touches personal data and note where it is hosted.
- Write a one page breach plan: who decides, who calls whom, who writes to the regulator.
None of this needs a large budget. It needs a few honest afternoons.
Where startups misread it
Two errors recur. The first is treating compliance as a banner: a cookie pop up and a privacy page, with nothing behind them. The second is treating it as a reason to stop: freezing product work until everything is perfect. Neither helps.
The better stance is proportion. Know what you hold. Hold less of it. Protect what remains. Be able to explain all of this to a customer in two paragraphs.
A hypothetical walk through
Picture a small health savings app. It collects name, phone number, date of birth, a self reported health condition so it can recommend a plan, and a selfie for identity checks. Applying the ideas above:
The health condition and the selfie are sensitive data. The app should ask itself whether it truly needs the condition to sell a savings plan, and if not, stop collecting it. If it does need it, it should say so plainly, explain the purpose, and restrict who can see it.
The selfie is used for identity checks, so the purpose is narrow. That means it should not later be used to train a model for a different feature without a fresh look at the basis for doing so.
The app uses a cloud provider abroad, so it needs to know where the data is stored and what safeguards apply to the transfer. It uses an SMS vendor, so it must know what that vendor does with phone numbers.
Each answer is small. Together they make the difference between a company that can explain itself and one that cannot.
Contracts with vendors and customers
If you act as a processor for other businesses, as many B2B startups do, your customers will ask for a data processing agreement. It sets out what you may do with their data, how you secure it, how fast you tell them about a breach and what happens when the contract ends. Having a standard version ready saves weeks in a sales cycle.
If you rely on vendors, ask for the same in return. A cloud, analytics or messaging provider is part of your compliance, and what they do with your customers' data remains your responsibility to explain.
Where the law is still settling
The regulator continues to issue guidance, thresholds and directions, and practice is still forming. Some questions, such as how strictly the Commission will treat transfers to common cloud services, are best answered by current guidance and counsel, not by a blog post.
Start with that inventory. A startup that can answer the question "what do you hold about me, and why?" is already most of the way there.