NDPR Readiness Checklist for Nigerian SaaS Startups

The Nigeria Data Protection Regulation was enacted in 2019¹ and reinforced by the Nigeria Data Protection Act 2023.² The number of Nigerian SaaS startups with genuine compliance is substantially smaller than the number that have published a privacy policy and believe that constitutes compliance.

Genuine NDPR compliance requires: registration with the NDPC, documented data handling practices, technical controls, lawful bases for processing, data subject rights procedures, incident response capability, and ongoing audit operations. The privacy policy is one small element of that set.

This checklist covers the requirements as they apply to a SaaS company collecting personal data from Nigerian individuals. It is organised by category and indicates the items that represent mandatory requirements versus best-practice enhancements.

Section 1: Registration and Administrative Requirements

1.1 Data Controller Registration

[MANDATORY] Register as a Data Controller with the NDPC³ if you process personal data of more than one thousand individuals per quarter
- Registration portal: ndpc.gov.ng
- Annual renewal required
- Fees vary by company size (SMEs: ₦100,000; Large organisations: ₦1,000,000)

1.2 Data Protection Officer

[MANDATORY for organisations processing large volumes of sensitive data] Designate a Data Protection Officer (DPO) or appoint a licensed Data Protection Compliance Organisation (DPCO)
- DPCOs are licensed by NDPC; list available on ndpc.gov.ng
- DPO must have access to senior management and function independently
- Document the DPO appointment and contact information in your privacy notice

1.3 Data Protection Audit

[MANDATORY for Data Controllers] Conduct an annual data protection audit and submit to NDPC by 15 March each year
- Audit must be conducted by a licensed DPCO
- Audit covers data inventory, lawful bases, data subject rights procedures, and security measures
- Non-submission is an enforcement trigger

Section 2: Data Inventory and Mapping

Before you can document your data handling practices, you need to know what data you hold.

2.1 Data Inventory

Identify all categories of personal data your systems collect (name, email, phone, payment data, IP address, device identifiers, usage data, etc.)
Document the purpose for which each category is collected
Document the legal basis (consent, contract, legitimate interest, legal obligation) for each category
Document retention period for each category
Document whether each category is shared with third parties and if so, which ones

2.2 Data Flow Mapping

Map how data enters your systems (web forms, API integrations, third-party data providers)
Map how data moves within your systems (between microservices, to analytics systems, to data warehouses)
Map how data leaves your systems (sent to third-party processors, exported by users, transmitted to partners)
Identify jurisdictions where data is stored or processed (relevant for cross-border data transfer requirements)

2.3 Third-Party Processor Register

List all third-party services that process personal data on your behalf (cloud hosting, analytics, CRM, email service providers, payment processors)
Confirm each has a Data Processing Agreement (DPA) in place or is available
Review the privacy practices of tier-one processors annually

Section 3: Legal Basis Documentation

NDPR requires a documented lawful basis for each category of personal data processing.

3.1 Consent Management (where consent is the basis)

Consent must be specific, informed, freely given, and unambiguous: pre-ticked boxes, bundled consent, and "by using this service you consent" language do not meet this standard
Record consent with timestamp, version of privacy policy at time of consent, and what the user consented to
Implement withdrawal of consent mechanism — must be as easy as giving consent
[CRITICAL] Do not use consent as the lawful basis for data that is necessary to provide the contracted service — use contractual necessity instead; consent-based processing must be optional

3.2 Legitimate Interests Assessment

For processing based on legitimate interests (analytics, security monitoring, product improvement), document a Legitimate Interests Assessment (LIA)
LIA must balance company interest against data subject rights and demonstrate processing is necessary and proportionate

3.3 Contractual Necessity

Document which data is processed because it is necessary to fulfil the contract with the user
Ensure this data is not retained beyond the period reasonably necessary for the contract

Section 4: Privacy Documentation

4.1 Privacy Notice

Comprehensive privacy notice accessible at registration and from a persistent site-wide link
Must cover: identity of controller, categories of data collected, purposes, legal bases, retention periods, third-party sharing, data subject rights, how to exercise rights, right to lodge complaint with NDPC, cross-border transfers
Written in plain language — not legal boilerplate that no user can parse
Updated whenever data practices materially change; version history maintained

4.2 Cookie Policy and Consent

Separate cookie disclosure covering categories of cookies, purposes, and third-party cookies
Consent mechanism for non-essential cookies (analytics, advertising)
Consent recorded and auditable
Cookies that do not have user consent must not fire

4.3 Internal Policies

Internal data protection policy documenting employee obligations
Documented data retention schedule with technical enforcement
Acceptable use policy for employee access to customer data

Section 5: Data Subject Rights Procedures

NDPR grants individuals rights to access, correct, delete, and restrict processing of their personal data.

5.1 Rights Implementation

Right of Access: Process to respond to access requests within thirty days; response includes all data held about the individual
Right of Correction: Process to update incorrect data upon request
Right of Deletion: Process to delete personal data upon request, subject to legal retention obligations; cascades to backup systems within a defined timeframe
Right to Restrict Processing: Mechanism to flag an account where processing is disputed without deleting underlying data
Right to Data Portability: Ability to export user data in a machine-readable format

5.2 Request Tracking

Log all data subject rights requests with timestamp, type, status, and response date
Set up internal reminders to ensure thirty-day response requirement is met
Document resolution actions taken for each request

Section 6: Technical Security Controls

NDPR requires appropriate technical measures to protect personal data.

6.1 Access Controls

Production database access restricted to named individuals with documented business need
Multi-factor authentication on all administrative access
Access reviews conducted quarterly; inactive accounts disabled promptly

6.2 Encryption

Personal data encrypted at rest in production databases
Sensitive fields (payment data, identity document numbers, health information) encrypted at the application layer, not just disk level
Personal data encrypted in transit (TLS 1.2 or higher on all endpoints)

6.3 Audit Logging

Log all access to records containing personal data with user identity, timestamp, and action
Log all administrative actions affecting personal data
Logs retained for minimum twenty-four months
Logs protected against tampering (append-only or separate access controls)

6.4 Vulnerability Management

Software dependencies scanned for known vulnerabilities as part of CI/CD pipeline
Annual penetration test of production environment by qualified external firm
Critical and high vulnerabilities remediated within defined timeframes

Section 7: Incident Response

7.1 Incident Detection

Monitoring and alerting for anomalous access patterns (bulk data access, access from unusual locations)
Process for employees to report suspected incidents to a designated person

7.2 Breach Notification Requirements

[MANDATORY] Under NDPR, a personal data breach must be reported to NDPC within seventy-two hours of awareness if it is likely to result in harm to data subjects
Documented incident response plan that includes: containment, investigation, notification decision tree, regulator notification procedure, affected individual notification procedure
Contact information for NDPC breach notification portal documented and tested
Template notifications prepared (regulator and individual) so they are ready before an incident occurs

7.3 Incident Register

Maintain a register of all security incidents and near-misses regardless of whether they trigger notification obligations
Register reviewed as part of annual DPA audit

Section 8: Cross-Border Data Transfers

If your SaaS uses infrastructure or services that store or process data outside Nigeria (AWS, Google Cloud, Cloudflare, Stripe etc.), cross-border transfer rules apply.

Document all cross-border transfers in your data inventory
Ensure a legal transfer mechanism is in place for each transfer:
- For transfers to countries with adequate data protection (EU, UK, etc.): adequacy assumption
- For other countries (including US): Standard Contractual Clauses (SCCs) or binding corporate rules, incorporated into the DPA with the service provider
Include cross-border transfer disclosure in privacy notice

Section 9: Ongoing Operations

Compliance is a state, not a one-time project. The practices that maintain compliance:

Annual NDPC audit submission (by 15 March each year)
Quarterly access rights review
Privacy policy review on any material change to data practices
Annual review of third-party processor list and DPA status
Data retention enforcement — automated deletion of data past its retention period
Annual staff data protection training for all employees who handle personal data
Penetration test annual
Model performance review for any AI or automated decision-making systems

Prioritisation for Early-Stage Companies

If you are an early-stage SaaS company and this list looks overwhelming, the prioritisation order is:

First thirty days (highest enforcement and business risk):

NDPC registration if processing >1,000 data subjects per quarter
Lawful basis documentation and consent mechanism implementation
Privacy notice that meets minimum requirements
Access controls: named accounts, MFA, production DB access restricted

Days thirty to ninety (investor readiness and regulatory completeness): 5. Data inventory and third-party processor register 6. Data subject rights procedures implemented and documented 7. Incident response plan documented 8. Audit logging implemented

Ongoing from month three: 9. Annual audit submission 10. Quarterly access reviews 11. Retention enforcement automation

The first four items close the most significant NDPR enforcement risks and satisfy the baseline investor and enterprise client requirements. The next four items complete genuine compliance. Everything after that is mature operational practice.

Compliance built in stages is far more effective than compliance built all at once under time pressure. Start with the first four this month.

Compliance Roadmap: Startup to International Scale — Stage-by-stage compliance framework from seed to enterprise
NDPR Compliance: From Cost Centre to Competitive Edge — Turning data protection into a business advantage
Nigerian Tech Regulatory Landscape 2026 — Complete reference guide to Nigerian technology regulation

Sources

Nigeria Data Protection Regulation (NDPR) 2019, issued by NITDA — nitda.gov.ng
Nigeria Data Protection Act (NDPA) 2023
Nigeria Data Protection Commission (NDPC) — ndpc.gov.ng
NITDA Act 2007