NDPA Compliance for Nigerian Websites: A Practical 10-Point Checklist
If your website has a contact form, a newsletter sign-up, a booking page or a checkout, it collects personal data: names, phone numbers, emails, addresses. In Nigeria, that puts your website under the Nigeria Data Protection Act 2023 (NDPA), enforced by the Nigeria Data Protection Commission (NDPC).
Many small businesses assume NDPA compliance is only for banks and telecoms. It isn't. The Act applies to anyone processing personal data of people in Nigeria, and the rules became more detailed when the NDPC's General Application and Implementation Directive (GAID) took full effect on 19 September 2025, replacing the old NDPR.
This checklist turns the law into 10 practical steps for a typical business website. It's a starting point, not legal advice: if you handle large volumes of data or sensitive data (health, finance, children), speak to a data protection professional.
Who the NDPA applies to
The NDPA applies to "data controllers" (who decide why and how personal data is used) and "data processors" (who handle it on someone else's behalf). If your website collects customer details for your business, you're a data controller.
Some organisations are classed as data controllers or processors of major importance because of the volume or sensitivity of data they handle, or their sector. These must register with the NDPC and may need to file annual compliance audit returns through a licensed Data Protection Compliance Organisation (DPCO). Check the NDPC's current thresholds to see whether this applies to you.
Why it matters for a small business
- Fines: under the NDPA, at the time of writing, penalties can reach the higher of ₦2 million or 2% of annual gross revenue, and the higher of ₦10 million or 2% for organisations of major importance.
- Trust: customers are more willing to share details with a business that clearly explains how it protects them.
- Partners: banks, payment providers and corporate clients increasingly ask about data protection before working with you.
Your NDPA compliance checklist (10 steps)
1. Publish a clear privacy notice
Add a Privacy Policy page and link it in your website footer and next to every form. In plain language, it should say:
- Who you are and how to contact you
- What personal data you collect (forms, cookies, orders)
- Why you collect it and your lawful basis (consent, contract, legal obligation, legitimate interest)
- Who you share it with (payment gateway, delivery company, email provider)
- How long you keep it
- People's rights and how to exercise them
- Whether data leaves Nigeria (for example, to a foreign email or analytics service)
2. Ask for consent before non-essential cookies
Analytics, advertising pixels and chat widgets usually set cookies. Show a cookie banner that lets visitors accept or reject non-essential cookies before they load, and link to a short cookie notice. Pre-ticked boxes don't count as consent.
3. Collect only what you need
Every extra field is extra risk. A contact form rarely needs a date of birth or home address. Remove fields you don't use. Schools need extra care because they hold children's data; see what a Nigerian school website should collect and protect.
4. Get clear consent on forms and newsletters
Add an unticked checkbox such as "I agree to receive updates by email" for marketing. Keep a record of when and how people signed up, and make unsubscribing easy.
5. Secure every page with SSL (https)
Forms must never send data over plain http. An SSL certificate encrypts information between the visitor and your site. If your browser shows "Not secure", fix it first; our guide on the "Not Secure" warning explains how.
6. Protect logins and keep software updated
Use strong, unique passwords and two-factor authentication for your hosting, WordPress and email accounts. Update WordPress, themes and plugins promptly; outdated plugins are the most common way small sites get hacked. Our website security guide for Nigerian SMEs covers the essentials.
7. Choose processors carefully
Your hosting company, email provider, payment gateway and CRM all process your customers' data. Use reputable providers, check their security, and know where they store data. If you take payments online, use a regulated gateway (see how to accept Paystack payments on WordPress) so card details never touch your own server.
8. Back up, and limit who has access
Keep regular backups so data isn't lost, and give staff access only to what they need. Remove access when someone leaves.
9. Have a data breach plan
Commentary on the GAID highlights a duty to report personal data breaches to the NDPC within 72 hours of becoming aware of them, where the breach is likely to put people at risk. Write down now who checks the breach, who reports it, and how you'll tell affected customers.
10. Respond to data requests
People can ask to see, correct or delete their data, or withdraw consent. Provide an email address for requests (for example privacy@yourbusiness.com.ng) and respond promptly.
A quick self-check
| Question | Yes / No |
|---|---|
| Is a privacy policy linked in the footer and beside every form? | |
| Does a cookie banner appear before analytics or ad tracking loads? | |
| Does every page load on https? | |
| Are marketing checkboxes unticked by default? | |
| Do you have backups and two-factor login on hosting and WordPress? | |
| Do you know what you'd do in the first 72 hours after a breach? |
If you answered "no" to any of these, start there.
Frequently asked questions
Does NDPA compliance apply to small businesses?
Yes. The NDPA covers any business processing personal data of people in Nigeria, whatever its size. Registration and audit filing obligations apply mainly to organisations of major importance, but basics such as privacy notices, consent and security apply to everyone.
Is the NDPR still in force?
No. The NDPC's GAID replaced the Nigeria Data Protection Regulation 2019 from 19 September 2025. The NDPA 2023 and the GAID are now the main rules.
Do I need a cookie banner on my Nigerian website?
If your site uses non-essential cookies such as analytics or advertising pixels, you should obtain consent before they are set and explain them in a cookie notice.
Does hosting my website in Nigeria make me compliant?
Not by itself. Where your data is stored matters for cross-border transfer rules, but compliance also depends on your privacy notice, consent, security and how you handle requests and breaches. Read more in local hosting and Nigeria's data laws.
Build compliance on a secure foundation
Many items on this checklist start with your hosting: SSL, backups, malware protection and secure logins. Every SternHost hosting plan, from ₦1,195/month, includes a free SSL certificate, daily backups and Imunify360 malware protection, with professional email on your own domain for privacy requests.
Host your website securely with SternHost and tick the technical items off your NDPA compliance checklist today. Need a hand with the website itself? Our web design team can build a privacy-ready site for you.
