Every business that collects customer details, maintains employee records, operates a website or uses digital platforms to process personal information has data-protection responsibilities. But who within the organisation ensures that these responsibilities are properly managed?
This is where a Data Protection Officer (DPO) becomes important.
Under the Nigeria Data Protection Act (NDPA) 2023 and the Nigeria Data Protection Commission’s (NDPC) General Application and Implementation Directive (GAID) 2025, organisations must pay attention to their data-protection governance arrangements, including the designation and effective functioning of a DPO where required.
For Nigerian businesses, understanding the DPO’s role is essential not only for regulatory compliance but also for protecting customer trust and reducing operational risks.
What Is a Data Protection Officer?
A Data Protection Officer is a person designated to advise an organisation on its data-protection obligations, monitor compliance and support the protection of individuals’ personal information.
The DPO serves as a link between the organisation’s management, employees, data subjects (the individuals whose personal data is being processed) and the relevant regulatory authority.
The role is not limited to technology companies or large financial institutions. Businesses in healthcare, retail, education, professional services, manufacturing and other sectors may also need appropriate DPO arrangements.
Importantly, a DPO is not simply someone appointed to hold a title. The person must have the knowledge, access, independence and resources necessary to perform the role effectively.
Does Your Business Need a DPO Under the NDPA?
Section 32 of the NDPA establishes the requirement for data controllers and data processors of major importance to designate a DPO. The GAID 2025 provides further guidance on the designation and responsibilities of DPOs.
A Data Controller is the person or organisation that determines why and how personal data is processed. A Data Processor processes personal data on behalf of a controller.
A Data Controller or Processor of Major Importance (DCPMI) is an organisation that falls within the NDPC’s regulatory classification based on applicable criteria, including the nature, scale and significance of its processing activities.
Businesses should assess their classification and applicable obligations rather than assume that a small workforce or limited physical presence automatically exempts them from requirements.
The GAID also provides for a DPO to be an employee or to perform the role under a service contract. This gives organisations flexibility in structuring their compliance arrangements.
For businesses uncertain about their obligations, a professional assessment can help establish the applicable requirements and the most appropriate approach.
The Key Responsibilities of a Data Protection Officer
1. Advising the Organisation on Data-Protection Obligations
The DPO helps management and employees understand their responsibilities under the NDPA, the GAID and other applicable data-protection requirements.
This includes explaining lawful processing, transparency, data minimisation, data security and the rights of individuals.
For example: If a company introduces a new customer relationship management (CRM) system, the DPO should help assess how customer information will be collected, accessed, stored and shared.
2. Monitoring Compliance
The DPO monitors whether the organisation’s data-processing activities align with legal requirements and internal policies.
This may involve reviewing privacy notices, assessing internal procedures, checking data-processing agreements and identifying compliance gaps.
The DPO should also help management understand outstanding risks and track corrective actions.
Monitoring compliance means checking whether the organisation’s policies and controls work in practice, rather than merely confirming that the necessary documents exist.
3. Supporting Privacy Risk Assessments
Some activities may create significant risks to individuals’ privacy.
A Data Protection Impact Assessment (DPIA) is a structured assessment used to identify and reduce privacy risks associated with high-risk processing activities.
The DPO advises on DPIAs where appropriate and monitors their implementation. This can be particularly important when introducing new technologies, processing sensitive personal data or undertaking large-scale processing.
4. Promoting Staff Awareness and Training
Employees can unintentionally expose personal information through careless email handling, weak passwords, improper file sharing or unauthorised disclosures.
The DPO helps develop data-protection awareness programmes so that employees understand their responsibilities and know how to handle personal information appropriately.
Training should be relevant to employees’ actual duties and refreshed as business processes and risks change.
5. Supporting Data Breach Management
A data breach may involve unauthorised access, accidental disclosure, lost devices or compromised systems.
The DPO should support the organisation’s breach-response process by helping assess privacy implications, coordinate relevant stakeholders, document decisions and advise on notifications where legally required.
The organisation must also maintain appropriate technical and organisational security measures. Appointing a DPO does not transfer all responsibility for data protection from management to that individual.
6. Helping Individuals Exercise Their Rights
The NDPA grants individuals rights concerning their personal data, including rights relating to access, rectification, objection and erasure in applicable circumstances.
The DPO helps ensure that the organisation has procedures for receiving, assessing and responding to requests within the applicable legal requirements.
The DPO’s contact details should also be accessible to individuals who need to raise data-protection questions or exercise their rights.
7. Reporting to Management and Supporting Regulatory Engagement
An effective DPO must have a meaningful connection to organisational decision-making.
Under the GAID 2025, the DPO’s position includes access to relevant processing activities, adequate resources and direct reporting to management. The framework also provides for periodic internal reporting on data-protection compliance.
The DPO may support regulatory engagement, including providing relevant information and helping coordinate responses to compliance concerns.
Management, however, remains responsible for ensuring that the organisation meets its legal obligations.
8. Maintaining Appropriate Documentation
Data protection compliance should be demonstrable.
The DPO helps maintain or oversee relevant records, including data-processing activities, privacy notices, risk assessments, staff training records, incident documentation and other compliance evidence.
This documentation helps the organisation identify weaknesses, demonstrate accountability and prepare for compliance assessments.
The GAID 2025 also provides for semi-annual internal data-protection reporting by the DPO. Organisations should incorporate this and other applicable requirements into their compliance calendars.
Can a Business Outsource Its DPO Function?
Yes. The GAID 2025 permits a DPO to perform the role under a service contract rather than exclusively as an internal employee. This can be useful for organisations that need specialist expertise without employing a full-time DPO.
An outsourced DPO arrangement can provide access to professional guidance, compliance monitoring, staff awareness support and privacy-risk management.
However, outsourcing the role does not remove the organisation’s legal responsibilities. Management must ensure that the appointed DPO has appropriate access, resources and authority to perform the function effectively.
It is also important to distinguish a DPO from a Data Protection Compliance Organisation (DPCO). A DPO performs an organisation’s internal or contracted data-protection oversight function, while a DPCO is an entity licensed by the NDPC to provide specified compliance services, including audits, advisory and training.
Businesses should also consider potential conflicts of interest, particularly where the same service provider performs multiple compliance functions.
What Should Businesses Do Next?
If your organisation has not reviewed its DPO arrangements recently, consider the following practical steps:
- Assess your obligations: Determine your classification and whether a DPO designation is required.
- Appoint an appropriately qualified person: Verify that the individual has suitable expertise for the role.
- Provide adequate support: Ensure access to management, relevant records, resources and ongoing training.
- Establish reporting procedures: Include compliance monitoring, periodic reports and corrective actions.
- Review the arrangement regularly: Reassess the DPO’s effectiveness as your organisation’s activities and risks evolve.
The NDPC also operates an official portal for verifying Data Protection Officer credentials. Businesses should use appropriate verification procedures when assessing prospective DPOs. <Cite refs={[“turn575929search7″,”turn575929search4”]}/>
Strengthen Your Data-Protection Governance with Hastrup Solicitors
Appointing a DPO is an important step, but it is only one part of an effective data-protection compliance programme.
Hastrup Solicitors provides data-protection advisory, NDPA compliance assessments, privacy audits, DPCO services, compliance documentation and ISO 27001-related advisory. We help organisations understand their obligations, identify compliance gaps and develop practical measures to protect personal information.
Whether your business needs guidance on appointing a DPO, reviewing an existing arrangement or implementing a broader compliance framework, obtaining professional advice can help you make informed decisions.
Is your organisation’s DPO arrangement fit for purpose? Contact Hastrup Solicitors to discuss your data-protection compliance needs.
