Data protection compliance is no longer simply a matter of having a privacy policy on your website. Under the Nigeria Data Protection Act (NDPA) 2023 and the General Application and Implementation Directive (GAID) 2025, organisations that collect and process personal data are expected to adopt appropriate governance, accountability and security measures.
Yet many Nigerian businesses remain exposed to avoidable data-protection risks.
Here are ten of the most common mistakes—and what businesses can do about them.
1. Thinking a Privacy Policy Means You Are Compliant
A privacy policy is important, but it is only one part of a data-protection compliance framework.
Some organisations publish a privacy notice on their website and assume the job is done. In reality, compliance involves how personal data is collected, used, stored, shared, secured and eventually deleted.
How to fix it: Conduct a proper data protection compliance audit covering your people, processes, systems, contracts and documentation.
2. Collecting More Personal Data Than You Need
“Just in case we need it later” is not a sound data-governance strategy.
Collecting excessive personal information increases your organisation’s privacy and security risks. The principle of data minimisation requires organisations to limit personal data collection to what is relevant and necessary for the intended purpose.
How to fix it: Review every major data-collection point—web forms, registration forms, HR systems, customer databases and mobile applications—and ask whether every field is genuinely necessary.
3. Assuming Consent Is Always Required—or Always Enough
Consent is one lawful basis for processing personal data, but it is not the only one.
Businesses sometimes request consent for virtually everything, while others assume that obtaining consent automatically makes any subsequent processing lawful.
Neither approach is correct.
A lawful basis is the legal justification for processing personal data. Depending on the circumstances, processing may rely on consent, contractual necessity, legal obligation or another recognised basis.
How to fix it: Identify and document the appropriate lawful basis for significant processing activities rather than using a generic consent statement for everything.
4. Not Knowing Where Their Data Actually Goes
Can your organisation answer these questions?
What personal data do we hold? Where is it stored? Who can access it? Which third parties receive it? Is it transferred outside Nigeria? How long do we keep it?
If the answer is “we’re not sure”, you have a data-governance problem.
Data mapping (the process of identifying how personal data moves through an organisation) provides the foundation for understanding these risks.
How to fix it: Create a data inventory and map significant personal-data flows across your organisation, including third-party and cloud services.
5. Ignoring Third-Party Data Processors
Your organisation may outsource payroll, cloud storage, email marketing, customer support, accounting, HR management or other functions involving personal data.
That does not mean your responsibility disappears.
A data processor is an organisation that processes personal data on behalf of a data controller. Businesses need appropriate contractual and governance arrangements with processors and other relevant third parties.
How to fix it: Review vendor relationships, identify who processes personal data on your behalf and ensure appropriate Data Processing Agreements (DPAs) and security obligations are in place.
6. Treating Cybersecurity and Data Protection as the Same Thing
They are closely related, but they are not identical.
Cybersecurity focuses primarily on protecting systems, networks and information against threats. Data protection also addresses the rights of individuals and whether personal data is processed fairly, lawfully and transparently.
The NDPC has itself highlighted the distinction between cybersecurity and privacy, noting that organisations may be familiar with security while being less familiar with the privacy rights guaranteed under the NDPA.
How to fix it: Integrate privacy governance with information-security management. Frameworks such as ISO/IEC 27001 can provide a structured approach to managing information-security risks.
7. Having No Proper Data Breach Response Plan
A data breach can result from hacking or ransomware, but it can also arise from something as simple as sending confidential information to the wrong recipient.
Waiting until an incident occurs before deciding what to do can make a bad situation considerably worse.
The NDPC provides a dedicated mechanism for reporting data breaches and privacy violations.
How to fix it: Develop a documented incident-response plan covering detection, containment, investigation, risk assessment, notification where required, remediation and post-incident review.
8. Forgetting About Data Subject Rights
Individuals have rights concerning their personal data, including rights relating to information, access, rectification, objection, restriction, portability and erasure in applicable circumstances.
The problem is that some businesses have these rights listed in their privacy policy but have no operational process for handling them.
For example, what happens if a customer requests access to the personal information your company holds about them?
How to fix it: Establish a documented procedure for receiving, verifying, assessing and responding to Data Subject Requests, including Data Subject Access Requests (DSARs).
9. Failing to Assess High-Risk Processing
New technologies and business processes can create significant privacy risks.
Large-scale processing, sensitive personal data, new technologies and other high-risk activities may require a Data Protection Impact Assessment (DPIA)—a structured process for identifying, evaluating and reducing privacy risks before or during processing.
The NDPC’s current regulatory framework places greater emphasis on risk-based compliance and accountability. GAID 2025 provides additional operational guidance for implementing the NDPA.
How to fix it: Introduce a privacy-risk assessment process and determine whether a DPIA is appropriate before launching high-risk processing activities.
10. Treating Compliance as a One-Time Exercise
Perhaps the biggest mistake is assuming that data protection compliance is something you “finish.”
Your business changes. You introduce new software, employ new staff, collect new information, engage new vendors and launch new services.
Your compliance framework must evolve with those changes.
The NDPC’s compliance approach includes governance, documentation and data-processing activities among the areas relevant to compliance assessment.
How to fix it: Establish an ongoing compliance programme involving periodic reviews, staff training, policy updates, risk assessments, vendor reviews and appropriate regulatory filings.
Compliance Is About More Than Avoiding Penalties
The purpose of data protection compliance is not simply to avoid regulatory sanctions. Effective data governance can strengthen customer trust, reduce operational risk and demonstrate that an organisation takes the protection of personal information seriously.
The NDPC identifies administrative and criminal sanctions, civil actions, reputational damage and potential loss of business opportunities among the consequences associated with non-compliance.
For Nigerian businesses, the question should therefore not be:
“Do we have a privacy policy?”
It should be:
“Can we demonstrate that our organisation has a functioning data-protection compliance framework?”
Is Your Business Compliant?
If your organisation is unsure about its current level of compliance, a data protection compliance audit can identify gaps and provide a practical roadmap for remediation.
Hastrup Solicitors provides NDPA compliance advisory, data protection audits, privacy and data-governance services, DPCO services, data-protection documentation, contractual advisory, breach-response support and ISO 27001-related compliance services.
The objective is simple: to help businesses move from merely having compliance documents to building a practical, defensible and sustainable data-protection framework.
Need help assessing your organisation’s data protection compliance? Contact Hastrup Solicitors for a professional compliance assessment.
