Data protection under the NDPA

The privacy console tabs and the breach clock.

The Nigeria Data Protection Act 2023 gives staff rights over their personal data and expects employers to show how they protect it. Vintage People keeps that work in one place, Settings, Data protection, open to people with the settings or data protection officer permission. It has five tabs.

Subject requests. Log each request against the employee and track it to its due date. An access request produces the person's full record as an Excel file or a zip of CSV files. Erasure takes two people: one approves and a different person fulfils it. It anonymises personal, contact, bank, next-of-kin, medical and document details, while payroll and tax records and the identifiers they need stay in the statutory archive.

Consent & lawful basis. Record what each person has agreed to and the lawful basis for processing, and honour withdrawals.

Retention. Set how long each category of data is kept. A daily sweep lists former employees who are due as proposals, and nothing changes until someone approves one. The statutory payroll and tax archive cannot be set below 72 months, and payroll records themselves are never deleted.

RoPA register. Keep your record of processing activities current. Every addition, edit and deletion is audited.

Breaches. Log a breach with when it was detected, the data involved and the people affected. The register counts down the 72 hours you have to notify the Nigeria Data Protection Commission, flags an overdue notice, and records when the Commission and the affected people were told.

Related articles