If your website collects names, email addresses or phone numbers from people in Nigeria, this guide is for you. It explains NDPA compliance for websites in plain English, based on the Nigeria Data Protection Act 2023 and the regulator's 2025 directive. You will finish with a clear list of what to fix this week.
What counts as personal data, and who the law applies to
The Nigeria Data Protection Act 2023 (NDPA) is Nigeria's main data protection law. The Nigeria Data Protection Commission (NDPC) enforces it. In March 2025, the NDPC issued the General Application and Implementation Directive (GAID), which took effect on 19 September 2025 and replaced the older 2019 regulation. Think of the Act as the rulebook and the GAID as the instructions for following it.
"Personal data" means any information that can identify a living person. Names, phone numbers, email addresses, home addresses, photos and IP addresses all count. If your website collects any of these, the law applies to you. You are what the Act calls a "data controller", because you decide why the data is collected and what happens to it. Companies that handle data for you, such as an email platform or web host, are "processors". You stay responsible for what they do on your behalf.
Size does not exempt you. A salon with a booking form, a consultant with a newsletter and a school with an enquiry page are all covered. The law also reaches foreign companies that target people in Nigeria.
One threshold deserves your attention. Under the NDPC's rules, an organisation that processes the personal data of more than 200 people in six months can be classed as a controller or processor of "major importance". That class also includes certain sectors, such as education, health, hospitality and e-commerce. Major-importance organisations must register with the NDPC, appoint a Data Protection Officer and file regular compliance reports. The lowest tier's annual registration fee is ₦10,000, and higher tiers cost more. A busy website can pass 200 contacts quickly, so check your position on the NDPC's website or with a licensed compliance organisation. Knowing who the law covers is the first step in NDPA compliance for websites.
Consent that actually counts: forms, ticks and pre-ticked boxes
Consent is where most owners slip when it comes to NDPA compliance for websites. Every use of personal data needs a lawful basis. Consent is one. The others most relevant to websites are contract (you need the data to deliver an order), legal obligation (keeping invoices for tax) and legitimate interests (a genuine business need that does not override the person's rights).
Match each thing your site does to a basis. A delivery address for a paid order falls under contract, so no consent box is needed. Weekly digital marketing emails need consent.
Where you rely on consent, it must be real:
- The person must act. Silence or inactivity is not consent, so a pre-ticked box does not count. Use an empty box or a button that clearly says "Yes, send me updates".
- Do not make it a condition. If someone must agree to digital marketing just to get a quote, the consent is not freely given.
- Keep it separate. Do not bury digital marketing consent inside "I agree to the terms".
- Say what they are signing up for. "Send me one email a week with pricing tips" is clear. "I agree" is not.
- Make withdrawal easy. People can object to marketing at any time, so every email needs a working unsubscribe link.
- Keep a record. The burden of proof is on you. Store who consented, when, and to what.
While you are here, open every form on your site and ask of each field: do we use this? A "Request a quote" form that asks for a home address and date of birth, when you only ever phone people, is collecting data you do not need. Delete those fields. Data you never collect cannot leak.
The privacy notice your site needs, and what belongs in it
Your privacy notice is how you keep the promise to be open with people. The GAID says notices must be clear, accessible and easy to understand, including for people with low literacy. It even encourages simple formats like infographics or translations. Link the notice in your footer and beside every form. It is also the first page people check when judging NDPA compliance for websites.
A good notice covers:
- Who you are, with a contact for privacy questions.
- What you collect, such as form details, order details and analytics data.
- Why you collect it, and the lawful basis for each purpose.
- Who receives it, by category: payment providers, email platforms, delivery partners, your web host.
- Whether it leaves Nigeria. Many email, analytics and cloud tools store data abroad, and transfers must meet conditions under the Act. The MultiChoice fine, which we cover below, included unlawful cross-border transfer.
- How long you keep it. Where no other law sets a period, the GAID's default is no more than six calendar months after the purpose is achieved. Tax records may need longer.
- People's rights: to see their data, correct it, ask for deletion in some cases, and object to marketing. Say how to make a request.
The most common mistake is copying a foreign template. It promises things you do not do and cites laws that do not apply. A short, honest notice beats a long borrowed one. You can see our approach in our own privacy policy.
Also set up one dedicated address, such as privacy@yourdomain, for requests. Decide who reads it and how you confirm a requester's identity. Then test it once by pretending to be a customer.
Cookies and analytics: what to ask permission for
The GAID draws a simple line. Necessary cookies keep the site working: a shopping cart, a login session, basic security. These do not need a consent tick, but mention them in your notice. Non-essential cookies and trackers are analytics, advertising pixels, retargeting and similar tools. For these, visitors must get a clear accept or reject choice.
The GAID also says where the banner goes: in the first visible section of the page. A notice tucked at the bottom, where people can miss it, does not meet the standard.
A practical routine:
- Find out what your site loads. Most owners are surprised by the list, and some trackers were added years ago by someone who left.
- Remove what you do not use.
- Show a short banner at the top of the visible page, explaining what you use and offering accept and reject.
- Check that rejecting works. Open your site in a private window, click reject, and see what still loads. Some banners look right while the trackers fire anyway.
You do not need an expensive foreign cookie-banner product for this. You need an accurate list of what your site runs and a banner that honestly matches it. For NDPA compliance for websites, that is the core of the cookie work.
Keeping data safe, and what to do if it leaks
The law expects security that fits the risk. For a typical small-business site, that means:
- HTTPS on every page
- Strong, unique passwords and two-step login on your website admin, hosting and email
- Regular updates to your CMS, themes and plugins
- Form submissions visible only to people who need them, with access removed when staff leave
- Backups stored away from the website itself
- No sensitive details collected through open email or chat
Most small-site breaches come from outdated plugins and weak admin passwords. Both are cheap to fix. Good security is a basic part of NDPA compliance for websites, and it does not have to be expensive.
If something goes wrong, speed matters. A breach that is likely to put people at risk must be reported to the NDPC within 72 hours of you becoming aware of it. Where the risk to individuals is high, you must also tell them immediately, including what they can do to protect themselves. If a processor, such as your host, suffers the breach, it must notify you.
You cannot invent a response in the middle of a crisis. Write a one-page plan now: who to call first, how to cut off access, what to record (what happened, when, which data, how many people), and who contacts the NDPC. Keep a copy somewhere you can reach even if the website is down.
Penalties, and the simple NDPA compliance for websites steps that keep you out of trouble
The NDPC can order you to fix a violation, pay compensation to affected people, hand over profits made from the violation, or pay a fine. The maximum fine is the higher of ₦10 million or 2% of the previous year's gross revenue for major-importance organisations, and the higher of ₦2 million or 2% for everyone else.
These are not empty threats. The NDPC fined MultiChoice Nigeria ₦766,242,500 in 2025 over data practices it called intrusive and disproportionate, plus unlawful cross-border transfers. It fined Fidelity Bank ₦555.8 million in 2024 for processing data without informed consent. In late 2025 it issued compliance notices to more than 1,300 organisations and gave each 21 days to show evidence of compliance. Most headline fines have hit large companies, but they were judged on rules you are also bound by: consent, data minimisation and transfers.
The good news is that NDPA compliance for websites is mostly housekeeping. If you do nothing else this week, do these five things:
- List every form and tracker on your site, including old pages nobody visits.
- Remove fields and tools you do not need.
- Untick every pre-ticked box and separate digital marketing consent from your terms.
- Publish or update your privacy notice and link it beside each form.
- Set up a privacy email address and a one-page breach plan.
This guide is general information, not legal advice. If you handle sensitive data such as health or financial records, or you are unsure whether you must register with the NDPC, speak to a data protection lawyer or a licensed compliance organisation.
Want it done for you?
Much of this is technical work: changing forms, cleaning up trackers, configuring a cookie banner that actually blocks what it should, tightening logins and updating your privacy page. If you would rather have NDPA compliance for websites handled for you, our team does it as part of our web and app development service. We review what your site collects, fix it, and give you a short record of what we changed.
Get in touch and we will start with a review of your current site.
Frequently asked questions
What is NDPA compliance for websites?
It means your website follows the Nigeria Data Protection Act 2023 whenever it collects personal data from people in Nigeria. You ask for consent properly and tell visitors what you do with their details. You also keep the data safe and have a plan if it leaks.
Does the NDPA apply to a small business website?
Yes, size does not exempt you. If your website collects personal data from people in Nigeria, the law applies to you. A salon with a booking form is covered, and so is a school with an enquiry page. Bigger organisations carry extra duties, such as registering with the NDPC.
Is a pre-ticked box valid consent under the NDPA?
No. Silence or inactivity is not consent, so the visitor must tick the box themselves. Keep marketing consent separate from your terms and say exactly what they are signing up for. Also record who agreed, when and to what, because the burden of proof is on you.
Does NDPA compliance for websites include a cookie banner?
Yes, if your site runs analytics or advertising trackers. Visitors must get a clear accept or reject choice, and the banner should sit in the first visible section of the page. Necessary cookies, such as a login session, do not need a consent tick.
How fast must I report a data breach in Nigeria?
Within 72 hours of becoming aware of it, if the breach is likely to put people at risk. You report it to the NDPC. If the risk to the people affected is high, you must also tell them immediately and explain what they can do to protect themselves.
What is the fine for breaking the NDPA?
The maximum is the higher of ₦10 million or 2% of the previous year's gross revenue for major-importance organisations. For everyone else it is the higher of ₦2 million or 2%. The NDPC can also order you to fix the violation or pay compensation to the people affected.