If your business stores a single customer’s phone number, the Nigeria Data Protection Act applies to you. The regulator is now actively enforcing it, and the penalties are tied to your revenue.
Of all the policies covered in this series, this is the one most small businesses do not realise applies to them. The Nigeria Data Protection Act 2023, enforced by the Nigeria Data Protection Commission (NDPC), governs how any organisation collects, stores and uses personal data. And “personal data” is broad: customer names, phone numbers, email addresses, payment details, employee records. If you keep any of that — and almost every business does — the law is talking to you.
This is no longer theoretical
The reason to take this seriously in 2026 is that the NDPC has moved from writing rules to enforcing them. It has issued compliance notices to thousands of organisations and is working through the economy sector by sector. The penalties for non-compliance are not trivial: administrative fines can be calculated with reference to your annual turnover, alongside enforcement orders and, in serious cases, prosecution. A fine tied to turnover is a fine that scales with the size of your business.
A penalty calculated against your turnover is a penalty that grows with your business. This is not a fixed slap on the wrist.
What compliance actually looks like for an SME
You do not need a legal department. You need to know what data you hold and treat it responsibly. Start by listing what personal data you collect, why you collect it, where it is stored and who can access it. Publish a clear, honest privacy notice for your customers, and get their consent where it is required. Secure the data with basic discipline — strong passwords, restricted access, and a plan for what you do if there is a breach. And never share or sell customer data without a lawful basis.
The bigger obligations — and the SME-friendly shortcut
Larger or higher-volume processors — what the law calls data controllers of major importance — must file annual Compliance Audit Returns with the NDPC, and may need to appoint a Data Protection Officer. The good news for smaller businesses is that the Data Protection Officer role can be outsourced to a specialist provider, giving you the expertise without the cost of a full-time hire. Check whether your data volume puts you in that category, and if it does, act on the filing deadlines, which the NDPC has been actively enforcing through 2026.
| ✓ YOUR ACTION CHECKLIST |
| ❑ List what personal data you collect, why, where it’s stored and who can access it. |
| ❑ Publish a clear, honest privacy notice and get customer consent where required. |
| ❑ Secure data: strong passwords, restricted access, and a plan for breaches. |
| ❑ Check whether you’re a “data controller of major importance” that must file an audit return. |
| ❑ Appoint or outsource a Data Protection Officer if your data volume requires one. |
| ❑ Never share or sell customer data without a lawful basis — fines scale with turnover. |
Previous — 7 of 10 New 2026 Nigeria Tax Policy Reform Series — Next
2026 Nigeria Business Policy Reforms Guide
- CAC in 2026: How to Register for as Little as ₦11,000 — and the New Ownership Rule You Can’t Ignore
- The Floating Naira and Your Business: How to Price, Plan and Survive When the Exchange Rate Moves
- Why Bank Loans Are So Expensive in 2026 — and Where Smart SMEs Find Cheaper Money Instead
- Your Bank Is Changing: What Recapitalisation Means for Your Business Accounts, Loans and Insurance
- The Data Protection Law Most SMEs Don’t Know They’re Breaking — and the Fines That Scale With Your Turnover
- The Nigeria Startup Act: How a Government “Label” Can Unlock Tax Breaks, Grants and Support for Your Tech Business
- NAFDAC, NCC, SON and the Rest: The Sector Rules That Can Shut You Down — or Open Big Doors
- From Naija to the World: How the Weak Naira and AfCFTA Make 2026 the Year to Start Exporting
