Reporting a personal data breach in Nigeria

When a Nigerian business must tell the NDPC and affected people about a personal data breach, what the notice must say, and first steps to contain it.

By Achekam · 11 October 2026 · 5 min read · For Running a business businesses in Nigeria

It usually starts with something small. A staff member e-mails the payroll spreadsheet to the wrong address. A laptop with customer files is stolen from a car. A shared folder link meant for one supplier turns out to be open to anyone who has it. Then someone asks the uncomfortable question: do we have to report this?

Under Nigeria's data protection rules, the answer can be yes, and the clock is short. This article explains when a Nigerian business must notify the Nigeria Data Protection Commission (NDPC) and the people affected, what the notice must contain, and the practical steps that help contain an incident in the first hours.

The clock: 72 hours to the NDPC, immediately to people at risk

Under the NDPC's General Application and Implementation Directive (GAID) 2025, issued under the Nigeria Data Protection Act, a data controller must notify the NDPC within 72 hours of becoming aware of a personal data breach that is likely to result in a risk to individuals' rights and freedoms. The same directive requires the controller to notify the affected data subjects immediately.

Three phrases in that rule decide what happens next:

• "Becoming aware." The clock starts when the business knows, not when the investigation is finished. A manager who sits on a report over a long weekend has used most of the time already.
• "Likely to result in a risk." Not every slip triggers a report. A file sent in error to a colleague who deletes it at once is different from a list of customers' bank details left open online. Decide quickly and write down why.
• "Immediately." People whose data is at risk should hear from you without waiting for the NDPC's reply, so they can protect themselves.

You can read the directive itself in the NDPC's GAID 2025, which also explains who counts as a data controller or processor of major importance and how registration and compliance audit returns work.

What the notice must contain

The GAID lists what a breach notice must include. Prepare each item as soon as you can:

1. The circumstances of the breach: what happened and how it was discovered.
2. The dates: when it happened, if known, and when you became aware.
3. The data involved: which kinds of personal data, such as names, phone numbers, salaries or medical details.
4. Your assessment of the risk to the people affected.
5. The number of individuals at risk, as best you can establish it.
6. The steps taken to contain the breach and reduce harm.
7. A contact person the NDPC and the affected people can reach.

If some facts are still unknown at the deadline, say so in the notice and say when you expect to know more. A late, perfect notice is worse than a timely, honest one.

The DPO's part

Under the GAID, a data controller or processor of major importance must designate a Data Protection Officer, publish the DPO's contact details and communicate them to the NDPC. The DPO reports directly to management. In a breach, the DPO is the natural person to lead the assessment, draft the notice and act as the contact person named in it. Whether your business must appoint one is covered in appointing a Data Protection Officer.

A business that is not of major importance still needs someone to take charge. Name that person now, not during the incident.

Why getting it wrong is expensive

The NDPC says a data controller or processor found in breach of a data subject's privacy rights may be ordered, under section 48(2) of the Act, to remedy the violation, pay compensation to the data subject, account for the profits realised from the violation, or pay a remedial fee. The NDPC adds that data subjects may also bring civil actions in court.

The people affected also have rights of their own. The NDPC states that sections 34 to 38 of the Act give data subjects rights including the right to be informed, to access, to rectification, to object, to restrict processing, to data portability and to be forgotten. Expect some of them to use those rights after a breach, and answer them properly.

First hours: shutting doors in your own systems

Containment is about closing whatever the breach opened. If the incident involves your Achekam workspace, several controls help.

• Revoke shared links. In Achekam a document can be shared by e-mailing a personal link with an expiry, an optional one-time code and downloading allowed or not, and the share can be revoked. If a link reached the wrong person, revoke it first and investigate second.
• Check earlier versions. Achekam's Document Centre keeps earlier versions when a new one is uploaded, which helps you see what a file contained before it was changed or replaced.
• Suspend accounts. A workspace administrator can suspend, reactivate or remove members. Suspend any account you suspect is compromised while you find out.
• Require two-factor sign-in. Users can turn on two-factor sign-in with an authenticator app, and the workspace can require it for all members. An accounting firm working in your books must also meet your business's own two-factor rules, so tightening the rule covers outsiders too.

None of this replaces the notification. It reduces the harm you have to describe in it.

A breach response plan on one page

Write this before you need it and keep it where the managers can find it:

1. Who decides: the DPO or named person, and a deputy.
2. How staff report a suspected breach: one phone number, one e-mail address.
3. Contain: revoke links, suspend accounts, change passwords, require two-factor sign-in.
4. Assess within hours: what data, how many people, what risk. Write the reasoning down.
5. Notify the NDPC within 72 hours where the risk test is met, using the GAID's list of contents.
6. Notify affected people immediately, in plain language, with what they should do.
7. Record everything: times, decisions, notices sent and replies.
8. Review afterwards: what failed, what changes, who checks it was done.

Whether the Act applies to your business at all is the starting point; see does the NDPA apply to you. If it does, a tested plan is the difference between a stressful week and a regulatory problem.

General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.