A client asked us last year, almost as an afterthought at the end of a project call, whether their new website "needed to do anything special" now that there was a data protection law in Nigeria. We didn't have a fully confident answer on the spot, and we told them so — this is genuinely one of those areas where the honest answer requires care, because getting it wrong in either direction costs something. Overstate the requirements and you scare a small business into paying for compliance work they don't need yet. Understate them and a business builds a website that's quietly exposed to real regulatory and reputational risk.
We want to be upfront about something before going further: this is not legal advice, and we're not lawyers. What follows is our understanding, built from working through this question with actual clients and reading the guidance the Nigeria Data Protection Commission has published, but if your business handles genuinely sensitive data at any real scale, this is worth a direct conversation with a lawyer or compliance consultant familiar with the Act, not just a blog post.
The Basic Shape of the Law
The Nigeria Data Protection Act, signed into law in 2023, replaced the older regulatory framework and established the Nigeria Data Protection Commission as the body overseeing enforcement. At its core, it governs how organizations collect, store, process, and share the personal data of people in Nigeria — names, email addresses, phone numbers, and anything else that can identify an individual, along with more sensitive categories like health or financial information that carry additional obligations.
The part that surprises a lot of small business owners is the scope. This isn't a law written only for banks and telecoms handling millions of customer records. If your website has a contact form that collects someone's name and email, if you run an email newsletter, if you store customer information in any system connected to your site, you're processing personal data under the Act, and some baseline obligations apply to you regardless of how small the business is. The specific compliance burden scales with what you're doing — a five-page business website with a simple contact form has a much lighter set of obligations than an e-commerce platform storing payment details and order histories — but "we're too small for this to apply to us" isn't actually how the law is structured.
What This Actually Means for a Typical Business Website
Stripped of legal language, here's what we've come to understand as the practical baseline for most small and mid-sized Nigerian business websites.
You need a clear, accessible privacy policy that actually describes what you do — not a generic template copied from another website, which is more common than you'd expect and arguably worse than having no policy at all, since it can describe practices you're not actually following. It should explain what personal data you collect, why you're collecting it, how it's stored, whether it's shared with any third parties, and how someone can request that their data be corrected or deleted.
You need a legitimate basis for collecting the data you're collecting, and you need to be reasonably transparent about it at the point of collection. If your website has a newsletter signup, a contact form, or a checkout process, the person filling it in should have a clear sense of what they're agreeing to — not a signup that quietly enrolls them in marketing emails they never explicitly consented to, buried in a checkbox nobody reads.
You need reasonable security measures around any personal data you're storing. This doesn't mean enterprise-grade infrastructure for every small business, but it does mean things like proper access controls on who inside your team can see customer data, secure handling of anything genuinely sensitive, and not storing more personal data than your business actually needs for a longer period than necessary.
And if your business handles a higher volume of personal data, or processes sensitive categories of data as a core part of what you do — health platforms, fintech products, HR systems — there are more formal obligations that kick in, including in some cases registering with the Nigeria Data Protection Commission and appointing someone responsible for data protection compliance within the organization. This is the point where we'd say clearly: talk to someone qualified rather than working this out from a blog post, because the specific thresholds and requirements here are detailed enough that getting them precisely right matters.
The Part Most Businesses Get Wrong: Third-Party Tools
Here's a gap we've seen catch businesses off guard. Most website owners think about their own forms and their own databases when they think about data protection, and completely overlook the third-party tools embedded in their website that are also collecting visitor data — analytics tools, marketing pixels, chat widgets, embedded booking systems. If your website runs Google Analytics, a Facebook pixel, or a live chat plugin, those tools are collecting information about your visitors too, and your privacy policy needs to account for that, because from a visitor's perspective, it's still your website doing the collecting, regardless of which company's code is actually running behind the scenes.
This is worth checking directly rather than assuming it's fine, because it's one of the more common gaps we find when we audit an existing website for a client who's asked us to look at this specifically — a privacy policy that describes the contact form accurately but says nothing about the four different tracking scripts also running on every page.
What We'd Actually Recommend Doing About This
If you're a small business with a fairly standard website — informational pages, a contact form, maybe a newsletter signup — the practical starting point is manageable: write an honest, specific privacy policy that actually describes what your site does, rather than copying a template wholesale. Audit what third-party scripts are actually running on your site and make sure they're accounted for in that policy. Make sure any consent you're collecting — for a newsletter, for marketing communications — is genuinely opt-in and clearly explained, not buried in fine print or bundled into a checkbox someone has to actively uncheck. And don't collect or store more personal data than you actually need for your business to function, since data you don't hold is data you can't mishandle or lose in a breach.
If your business is handling anything more sensitive — payment data, health information, large customer databases, anything that would be genuinely damaging if it leaked — this is where the conversation needs to move from "read a blog post" to "get proper legal and technical guidance," because the obligations scale up meaningfully at that point, and the cost of getting it wrong scales up right alongside them.
We'd also gently push back on the instinct to treat this purely as a compliance box to check. Most of what the Act asks for — being honest about what data you collect, not hoarding more than you need, keeping it reasonably secure — is close to what a well-run business should be doing anyway, law or no law. The businesses that find this genuinely burdensome are usually the ones that were already being careless with customer data before the Act gave that carelessness a name and a potential penalty attached to it.
