Discuss your project
Cybersecurity

Privacy and compliance readiness

Data protection law, sector rules, contracts and insurers expect you to protect information and prove it. We close the technical and operational gaps and prepare evidence, alongside your legal adviser; we do not give legal advice or certify compliance.

Discuss your project How the work is delivered

A good fit if

  • You hold personal data and doubt your practices would survive a complaint, NDPC enquiry or breach investigation.
  • You may need NDPC registration as a controller or processor of major importance, or a data protection officer.
  • You handle health or other sensitive data, or are (or supply) a bank, payment provider, insurer, pension or capital-market operator.
  • A client, insurer or auditor sent a security questionnaire, or you are preparing for SOC 2 or ISO/IEC 27001.

What is included

  • Map of laws, rules, contracts and frameworks, confirmed with your legal adviser
  • Inventory of personal data: where it lives, access, retention
  • Gap review of safeguards and prioritised remediation plan with owners and effort
  • Breach response plan for the 72-hour NDPC window, and a breach register
  • Vendor and cloud contract terms reviewed; DPIAs supported, including transfers abroad
  • Evidence packs and answers to client, insurer and auditor questionnaires

Requirements we commonly prepare for

Readiness means meeting the requirements that apply to you and being able to show it. Your legal adviser decides what applies and how to read it; independent auditors and certifiers decide whether you meet a standard. We turn their requirements into systems, procedures and evidence, and flag legal questions instead of guessing.

RequirementWhat it covers
NDPA 2023, enforced by the NDPCThe main data protection law: lawful basis and consent, data subject rights, data protection officers, impact assessments for high-risk processing, transfers outside Nigeria, breach notification.
NDPC GAID 2025How the NDPA applies in practice, including registration of controllers and processors of major importance.
Health dataSensitive personal data under the NDPA, plus National Health Act 2014 confidentiality duties: clinics, laboratories, hospitals, health-tech.
CBN, SEC Nigeria, NAICOM, PenComCBN cybersecurity framework and guidelines for banks and payment service providers; capital-market operators, insurers, pension operators; and their vendors.
Direct marketingNDPA consent rules and the NCC's rules on unsolicited messages, where email and SMS marketing are in scope.
ISO/IEC 27001, SOC 2Often requested by enterprise and international clients; issued by independent auditors and registrars.
Regulated clients, insurersSector assessments of suppliers; insurer questions on MFA, EDR, backups, email security, training; clauses on data location, breach notification, subcontractors.
General summaries, not legal advice. Your adviser should confirm what applies to you. For AI questions in audits, insurance and due diligence, AI governance documents AI use, risks and controls (NIST AI RMF, ISO/IEC 42001).

Breach readiness

With 72 hours to notify the NDPC, and early decisions hard to undo, the plan names who does each step; we rehearse it with you in a tabletop exercise.

  1. ContainStop the incident spreading.
  2. Assess riskIs it likely to risk individuals' rights and freedoms?
  3. DecideNotify the NDPC and affected people, with your insurer and adviser.
  4. RecordKeep the breach record. See breach reporting.

Technical gaps? Security assessments measure controls in depth; cybersecurity closes them: EDR, email security, awareness training.

Delivery

How the work is delivered

  1. Scope the requirements

    Identify the laws, sector rules, contracts and frameworks likely to apply; confirm them with your legal adviser.

    Output: Requirements map.

  2. Understand your data

    Inventory what personal data you collect, why, where it lives, who sees it and for how long.

    Output: Data inventory and flow diagram.

  3. Review the gaps

    Compare your technical and organisational safeguards with the requirements, and rank gaps by risk.

    Output: Gap report and remediation plan.

  4. Close the gaps

    Update controls, procedures, contracts and training; build the breach plan and register.

    Output: Updated safeguards and breach plan.

  5. Prepare the evidence

    Assemble what an auditor, insurer or regulator would ask for, and rehearse a breach scenario.

    Output: Evidence pack and tabletop results.

Scope at a glance

Not included unless agreed

  • Legal advice, opinions, certification, attestation or audit reports
  • Filing breach reports or notifying individuals for you
  • Fixing technical findings, unless in scope or separately agreed

What we need from you

  • A named person accountable for data protection (often legally required)
  • Your legal adviser's input, policies, contracts, questionnaires and incident records
  • Time with whoever manages IT, HR, finance and client records

Before handover

  • Each requirement in scope traced to a control, owner and evidence
  • Open gaps listed with an owner and date; legal questions left to your adviser
  • Breach plan rehearsed by its users; documents your staff can maintain

What affects the cost

  • Laws, rules and frameworks in scope
  • Amount and sensitivity of personal data
  • Systems, vendors and locations
  • Existing evidence, and whether remediation is included

No package prices: estimates in naira from an agreed scope, taxes shown separately.

Questions buyers usually ask

What does the NDPA require after a breach?

In general terms, under the Nigeria Data Protection Act 2023 a controller must notify the NDPC within 72 hours of becoming aware of a breach likely to risk individuals' rights and freedoms, and tell affected people without undue delay where the risk is high. Critical national information infrastructure operators have further duties.

Does hosting our data in a particular country or data centre make us compliant?

Not on its own. Nigeria has no major public cloud region, so it is usually a local data centre (Lagos, Abuja) or a region abroad; either can work. NDPA transfer rules, sector rules, access controls, contracts, support access and backups matter too. We review the whole picture.

We are a small organisation. Does this apply to us?

Generally yes. Data protection obligations apply regardless of size when you handle personal data, but the work scales down to a focused data inventory, a breach plan and a handful of well-run controls.

Service

Cybersecurity services

Assessments, endpoint protection, email security, training, incident readiness, and 24/7 monitoring for managed-service clients.

Has a client, insurer or regulator started asking questions?

Tell us what has been asked and what information you handle. We will reply to arrange a conversation about getting ready.

Discuss readiness