Data breach notification under Nigeria's NDPA

The duty in section 40

Section 40 of the Nigeria Data Protection Act, 2023 requires a data controller to notify the Nigeria Data Protection Commission within 72 hours of becoming aware of a personal data breach that is likely to result in a risk to the rights and freedoms of individuals. A data processor that becomes aware of a breach must notify the controller without undue delay.

Telling the people affected

Where a breach is likely to result in a high risk to data subjects, the controller must communicate it to them immediately, in plain and clear language, with advice on the measures they can take to reduce the harm. If individual notice would be disproportionate, a public communication can take its place.

What to report

• The nature of the breach, including the categories and approximate number of data subjects and records
• The name and contact details of a contact point, usually the DPO
• The likely consequences of the breach
• The measures taken or proposed to address the breach and mitigate its effects

Where the facts are not all known within 72 hours, report what you know and supplement it as the investigation continues.

Keeping the record

The NDPC expects every breach to be recorded, including those you decided not to notify, with the facts, effects and remedial action. hlola's breach register runs the 72-hour clock from the awareness time, records the notification decision and its reasons, and keeps the regulator acknowledgement as evidence.

Common questions