Personal data enters a startup through ordinary product activity. People sign up for accounts and analytics tools record how they use the app, while support tickets collect whatever customers choose to type in. Before the company can decide how it may use and protect that information, it needs to know where the data comes from and where it goes.
That is why I always suggest starting with a map of the data. The map connects the privacy notice to the product the team is actually building, and it guides decisions about suppliers and how long data is kept. The company's legal obligations depend on what it processes and how the NDPC classifies it, so those obligations should be checked at the first launch and again as the product grows.
Follow the data through the product
The map should cover what users provide directly and what the company collects through analytics tools and third‑party integrations. For each type of data, it should record the purpose, who can see it, including staff and any hosting outside Nigeria, how long it is kept and what triggers its deletion.
The company also needs to work out its role for each activity. A SaaS company that processes a client's customer records on the client's instructions is a processor for that data, but the same company decides for itself how to use its own billing information, which makes it a controller for that data, so one company can hold both roles for different sets of data.
The Nigeria Data Protection Act 2023 is supplemented by the General Application and Implementation Directive (GAID) 2025, which has applied since 19 September 2025 and replaced the old NDPR, and the NDPC's annual report describes how the directive is being implemented. The company's processes and supplier contracts should be reviewed against both.
A lawful basis for each use
The Act allows personal data to be processed on the basis of consent, contract, legal obligation, vital interests, public interest functions or legitimate interests, and the company should choose the basis that genuinely fits each activity. Processing needed to deliver the service a user signed up for rests on a different basis from marketing the company would like to send them afterwards.
Where the company relies on consent, it should explain the choice clearly and make it easy for people to withdraw. Where it relies on legitimate interests, it should record why the processing is needed and why it does not override the person's rights. Sensitive personal data, such as health or financial information, needs additional conditions, and data about children requires age checks and the consent of a parent or guardian.
The basis should be reviewed whenever the purpose changes. If the company buys a database or acquires another business, it should check whether it can use the data for its own purposes and what it needs to tell the people concerned, and I look at this from the seller's side in closing a startup and settling what remains.
Tell people what happens and let them use their rights
The privacy notice should explain the purposes of processing, who receives the data, how long it is kept and what rights people have, in language they can understand. What it says about tracking and marketing must match the product's actual settings, and it should give a contact address that someone monitors, so that people can reach someone who can deal with their request.
The company should have a process for access and correction requests, with identity checks that are proportionate to the risk. For deletion requests, it should separate data it can delete from records it must keep by law, and explain the outcome to the person.
Requests to withdraw consent or to move data to another service each have their own rules, as do objections to processing. If the company makes significant automated decisions about people, it should check whether those people are entitled to human review, and the person who handles requests should have a direct line to the product team, because data is usually held in several systems.
Suppliers and transfers outside Nigeria
Every supplier that processes personal data for the company needs a data processing agreement covering its instructions, its safeguards and its use of subcontractors, together with its duty to help with breaches and requests. The agreement should also say how the company will be told about changes in subcontractors or locations.
Transfers of personal data outside Nigeria need a lawful route under the Act and the GAID, such as adequate protection in the destination country or appropriate safeguards. Founders often forget that hosting outside Nigeria, and support staff accessing data from another country, also count as transfers, and the company should keep evidence of the route it relies on.
Access to personal data should be limited according to role, and recovery credentials should be protected. Data should be encrypted in storage and in transit where appropriate, and backup restoration and deletion should be tested. Staff should also be trained on the company's own systems, including where to send a rights request or a suspicious email.
Check the risk before launching a high‑risk feature
Before building a high‑risk feature, such as biometric checks or large‑scale profiling, the company should check whether it needs a data protection impact assessment. The GAID makes these assessments mandatory for high‑risk processing, including processing that uses new technologies, and the findings should be used to reduce the data collected to what the feature actually needs before it is launched.
The volume of data the company processes and the sector it operates in decide whether it is a data controller or processor of major importance. If it is, it must register with the NDPC and appoint a qualified data protection officer, and it must also file annual compliance audit returns, with filing fees based on its tier. Someone should be given responsibility for making that assessment, with the reasoning kept on file and reviewed as the company grows.
Have an incident plan before you need one
A processor must tell the controller about a breach without undue delay, and a controller must notify the NDPC within 72 hours of becoming aware of a breach that is likely to put people's rights and freedoms at risk. Where the risk is high, the people affected must also be told promptly, in clear language, with steps they can take to protect themselves.
Every incident should be recorded, together with the decision on notification and the reasons where the company decides the threshold has not been met. Containing the breach and preserving evidence happen alongside the investigation, and because the time limit for notification continues to run during the investigation, the company should decide in advance who makes the decisions and how suppliers can be reached outside working hours.
As the product changes, the data map and the privacy notice should be updated, and the company should check that its supplier contracts still fit and that its processes for deletion and requests still work. If a customer or the NDPC asks how the company uses personal data, that record is the answer.
This article is general information and not legal advice. For guidance on your specific circumstances, speak with us directly.