The short answer
Under the Nigeria Data Protection Act 2023 (NDPA), enforced by the Nigeria Data Protection Commission (NDPC), a personal data breach of data you control means:
- Notify the NDPC within 72 hours of awareness, if likely to risk individuals' rights and freedoms.
- Tell affected individuals without undue delay where risk is high.
- Notify others who need to know or can reduce harm.
- Record every breach, reported or not, with your reasoning.
Other duties and enforcement
Processors, infrastructure, penalties. If you are a data processor, notify the controller first; others may include law enforcement, a payment processor or your sector regulator. Operators of critical national information infrastructure have further incident-reporting duties under the Cybercrimes Act (as amended) and to ngCERT, the national computer emergency response team. The NDPC can take enforcement action, including penalties; we do not state amounts: check the current Act and the Commission's directives, including the General Application and Implementation Directive (GAID) 2025. General information, not legal advice; sector rules may add obligations (below).
What counts as a breach
In general terms, a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. Common examples:
- Ransomware or intrusion exposing customer or employee records
- Personal data emailed to the wrong recipient
- Lost or stolen laptop, phone or USB drive
- Cloud folder or database left public
- Staff viewing records without a business reason
The risk test
The NDPA ties notification to risk to individuals' rights and freedoms. Harm can include:
- Financial loss
- Fraud and identity theft
- Damage to reputation or relationships
- Lost employment or business opportunities
- Discrimination
- Distress
- Physical harm, in some cases
Whether risk is likely, and whether it is high, turns on two factors:
| Factor | What to consider |
|---|---|
| Sensitivity of the data | Health, financial and identity data are generally sensitive (the NDPA treats health data as sensitive personal data), but context matters: a list of names can be sensitive if it reveals membership in a support group |
| Probability of misuse | Who obtained it, how long it was exposed, evidence of malicious intent, whether it was encrypted or otherwise unusable, whether harm has already occurred |
Document your reasoning either way: the record should let the NDPC or your legal adviser verify your assessment.
Example: two lost laptops
| Two hypothetical lost laptops | Facts | A reasonable conclusion |
|---|---|---|
| Laptop A | Full-disk encryption on, key not stored with it, reported lost within an hour | Low probability of misuse: record the breach and its assessment, and not report |
| Laptop B | Unencrypted, with a spreadsheet of client names, dates of birth and banking details | Sensitive, readily usable: risk likely, probably high. Notify the NDPC within 72 hours, tell the clients, consider notifying their banks |
Your own assessment depends on your facts.
Notifying the NDPC
The 72 hours run from awareness. Do not wait for the investigation to finish: notify with what you know, update as you learn more, and if you cannot give everything in time, report promptly and explain what is still unknown. Check the NDPC website for its current channel and any required form. In general terms, cover:
- Nature of the breach and, if known, cause
- Date or period (or approximation)
- Categories and approximate number of individuals and records
- Likely consequences for individuals
- Measures taken or proposed to address it and reduce effects
- Name and contact of your DPO or another person who can answer questions
Notifying individuals
Where the risk is high, tell people without undue delay, clearly enough to understand the significance and protect themselves. Include:
- What happened and when (or approximately)
- Personal data involved
- What you did to reduce the risk
- What they can do (change passwords, watch accounts)
- Contact for questions
Notifying other organisations
Tell any organisation that can reduce harm or must know under its own rules: law enforcement, a bank or payment processor that can monitor or block accounts, a service provider whose system was involved, your sector regulator. Banks and payment service providers should check the Central Bank of Nigeria's incident-reporting requirements; critical national information infrastructure operators should also report to ngCERT.
Keeping breach records
Record every personal data breach, whether or not it met the threshold: it shows the NDPC, an auditor or your insurer how you assessed and handled it. The NDPA and NDPC directives give no retention period we can state here, so agree one with your legal adviser and keep the register at least that long.
Breach record template
- Date or estimated date of the breach, and date discovered
- General description of the circumstances and cause
- Nature of the personal data involved
- Number of individuals and records affected (or estimate)
- Risk assessment and reasoning, including whether the risk is high
- Whether reported to the NDPC, and when
- Whether individuals were notified, how and when
- Other organisations notified
- Containment and corrective actions taken
Service providers and accountability
A breach at a provider holding personal data for you (cloud host, payroll or IT provider) generally leaves you accountable as controller. Contracts should require prompt notice and cooperation, fast enough for your 72-hour window. If you are the processor, tell the controller without delay.
Sector-specific rules
The NDPA may not be the only framework:
| Sector | Also applies |
|---|---|
| Banks and payment service providers | CBN cybersecurity framework and guidelines |
| Insurers, pension operators, capital-market operators | NAICOM, PenCom and SEC Nigeria respectively |
| Health | Sensitive personal data under the NDPA; National Health Act 2014 confidentiality duties |
| Public institutions | Their own rules, including NITDA guidelines |
Check each type of data you hold, and plan for more than one notification.
A response sequence to prepare in advance
- ContainRevoke access, isolate systems, recover devices or data.
- Preserve evidenceStart a timeline: the 72 hours run from awareness.
- AssessWhat data, whose, and the risk to individuals.
- Decide, documentWhat each applicable law or rule requires.
- Report, notify, recordWithin the deadline, including organisations that reduce harm; record unreported breaches.
- ReviewFind what failed and fix it.
Assign an owner for each step beforehand, keep someone reachable outside office hours and when office power or internet is down, and rehearse with a tabletop exercise.
Limitations
This guide summarises the framework as of its review date. It does not cover every scenario or sector rule and is general information, not legal advice; NDPC directives and guidance change, so check current versions. For a specific incident, involve legal counsel early. To prepare policies, a breach register and a response plan in advance, see our privacy and compliance readiness service.
Sources and further reading
Product capabilities and guidance change. These are the primary sources this article relies on, checked on the review date above.
- Nigeria Data Protection Act 2023, GAID 2025 and breach notification guidance, Nigeria Data Protection Commission
- National Computer Emergency Response Team (ngCERT), ngCERT
This article is general information, not legal, accounting or security advice for your specific situation. Examples are hypothetical unless stated otherwise.