Nigerian businesses built on digital tools are now running a compliance risk they cannot see

Log in or create a free account to get started.

Read History Go to My Account Log Out Enhanced by Google Opinion Nigerian businesses built on digital tools are now running a compliance risk they cannot see Every time a customer fills in a form on your website, sends a message on WhatsApp, or hands over a

Listen to this article Share Every time a customer fills in a form on your website, sends a message on WhatsApp, or hands over a phone number at the point of sale, your business collects personal data. Every time you store that information in a spreadsheet, share it with a delivery company, or upload it to a marketing platform, you are processing personal data under Nigerian law. The Nigeria Data Protection Act 2023 applies to all of this. And based on the enforcement pattern the Nigeria Data Protection Commission has established over the past two years, the majority of Nigerian businesses are doing most of it without meeting their legal obligations.

The law itself is not complicated in principle, even if the implementation takes work. The Nigeria Data Protection Act 2023 requires any business that collects or uses the personal data of Nigerian residents to have a lawful basis for doing so, to tell people what data is being collected and why, to keep that data only as long as necessary, and to protect it with appropriate technical and organisational measures. Businesses that process large volumes of personal data or handle sensitive categories of data are required to register with the NDPC as data controllers or processors of major importance, appoint a Data Protection Officer, and file annual Compliance Audit Returns. The 2025 Compliance Audit Return deadline passed in May 2026. Many businesses missed it.

Where most Nigerian businesses fall short is not through deliberate disregard of the law. It is through a set of habits that predate the law and have never been examined against it. A trading company that keeps a WhatsApp group of five hundred customers and sends them promotions every week is processing personal data. If those customers were never told their number would be used for marketing, and never given a clear way to opt out, that processing does not have a lawful basis under the NDPA. A logistics company that shares a spreadsheet of customer names, addresses, and phone numbers with a third-party dispatch rider service has transferred personal data to a processor. If there is no data processing agreement in place between the two businesses, that transfer is non-compliant. A professional services firm that stores client files in a shared Google Drive folder, accessible to every member of staff regardless of whether they need that access, has failed to implement appropriate access controls. None of these businesses set out to break the law. All of them are breaking it.

The penalties are structured in a way that scales with the size of the business. Non-compliance can attract a fine of up to 10 million naira or two per cent of the preceding year’s annual gross revenue, whichever is greater. For a business turning over 500 million naira annually, that is a potential exposure of 10 million naira per violation, not per investigation. For a larger business, two per cent of gross revenue is a number that concentrates the mind considerably. Beyond the financial penalty, a finding of non-compliance by the NDPC is a reputational event. As more Nigerian businesses conduct supplier and partner due diligence, data protection compliance is becoming part of the commercial conversation in the same way that tax compliance already is.

The National Assembly signalled in May 2026 that it intends to amend the NDPA specifically to address artificial intelligence and automated decision-making. Industry observers expect the amendments to introduce mandatory algorithmic impact assessments for high-risk AI systems, a right for individuals to request human review of decisions made by automated systems, and stricter rules around cross-border data transfers. The businesses that wait for those amendments before reviewing their data practices will be retrofitting compliance at considerably higher cost than the businesses that build it in now. The current NDPA already applies to any AI system that processes personal data. The amendment will not create the obligation. It will sharpen and extend one that already exists.

What compliance actually looks like in practice for a small or medium business is less daunting than the legal language implies. It begins with a data audit: mapping what personal data the business holds, where it came from, what it is used for, who has access to it, and how long it is kept. Most businesses that do this exercise honestly find that they are holding data they no longer need, sharing it with parties they have not formally authorised, and keeping it in systems with weaker security than the sensitivity of the information warrants. The audit is uncomfortable. It is also the only way to understand what needs to be fixed.

From the audit, the practical steps follow in order. Privacy notices need to be drafted and placed where customers can read them before their data is collected. Consent mechanisms need to work: a pre-ticked box is not consent under the NDPA and neither is the absence of objection. Data processing agreements need to be signed with every third-party service that handles customer data on the business’s behalf, which in most cases includes the accounting software, the email marketing platform, the cloud storage provider, and the courier company. Staff who handle personal data need to understand what they can and cannot do with it, and that understanding needs to be documented rather than assumed.

None of this is beyond the reach of a Nigerian SME operating without a dedicated legal team. Much of it is common sense applied consistently. The businesses that treat data protection as a box to tick before a regulator comes knocking will spend considerably more time and money than the businesses that treat it as a standard of operational hygiene that the law has now made mandatory. The NDPC has demonstrated that it is willing to enforce. The question for every business owner sitting with this is not whether the regulator will eventually reach their sector. It is whether they want to be the example that teaches the rest of their industry what the consequences look like.

Olufemi Oluoje is a seasoned AI consultant and software developer with over 8 years of experience delivering innovative tech solutions to organisations and specializes in helping small businesses harness AI to boost productivity, reduce costs, and drive profitability. Olufemi focuses on creating tailored AI-powered solutions for SMEs and offers training to help teams effectively adopt AI. For inquiries, contact hello@aiforsme.ng, aolufemi.oluoje@gmail.com.