HexagonDPO helps organizations build practical data protection, privacy, and compliance programs that meet NDPA, NDPC, GDPR, and global best-practice requirements.
HexagonDPO helps organizations build practical data protection, privacy, and compliance programs that meet NDPA, NDPC, GDPR, and global best-practice requirements.
A data breach is not just an IT incident. In Nigeria, it can quickly become a regulatory, legal, reputational, and customer-trust issue, especially where personal data is lost, accessed without authorisation, disclosed to the wrong person, altered, destroyed, or exposed through a system weakness.
Under the Nigeria Data Protection Act 2023 and the NDPC's General Application and Implementation Directive 2025, organisations are expected to respond quickly, preserve evidence, assess risk, contain harm, and notify the Nigeria Data Protection Commission where required. The first few hours matter.
Do not start with public statements or blame. Start with facts. Identify the affected system, the type of personal data involved, whether the data was viewed, copied, changed, encrypted, deleted, or sent outside authorised channels, and whether the incident is still active.
Containment should happen fast, but carefully. Disable compromised accounts, rotate exposed credentials, isolate affected devices or servers, suspend vulnerable integrations, and restrict unnecessary access. If a vendor or cloud provider is involved, notify them formally and demand incident details without delay.
Avoid deleting files, wiping systems, or changing configurations in a way that destroys evidence before proper forensic review. A clean record of what happened helps the organisation prove accountability and make accurate regulatory notifications.
The legal question is not only whether a system was attacked. It is whether the breach is likely to result in a risk, or high risk, to the rights and freedoms of individuals. A breach involving names and phone numbers may be serious; a breach involving identity documents, financial records, health data, login credentials, children's data, or large-scale customer records is usually more sensitive.
Where a breach is likely to result in a risk to individuals' rights and freedoms, the data controller should notify the Nigeria Data Protection Commission within seventy-two (72) hours of becoming aware of the breach. For high-risk breaches, affected data subjects should also be notified immediately so they can protect themselves.
The NDPC provides an official breach reporting portal for data protection and privacy violations. A strong notification should not be vague. It should explain what happened, when it happened, the personal data affected, the estimated number of individuals involved, the likely harm, what has been done to reduce the risk, whether affected individuals have been notified, and who the Commission can contact for follow-up.
If individuals need to take protective action, the message should be direct and useful. Tell them what happened, what categories of data were involved, what the organisation has done, what they should do next, and where they can get support. Avoid overpromising, hiding uncertainty, or using technical language that customers cannot act on.
After containment and notification, the organisation should complete a root-cause review. This may involve patching software, improving access controls, enforcing multi-factor authentication, updating vendor contracts, retraining staff, reviewing retention practices, or conducting a Data Privacy Impact Assessment where a system or process creates elevated risk.
Keep a breach file. It should include the incident timeline, evidence reviewed, decisions made, notifications sent, remediation actions, lessons learned, and management approvals. If the NDPC asks questions later, this record becomes part of your accountability evidence.
A breach should be reported where it is likely to result in a risk to the rights and freedoms of individuals. The safer approach is to assess and document every incident, then report where the legal threshold is met.
Where the breach is likely to result in high risk, affected data subjects should be notified immediately so they can take steps such as changing passwords, watching for fraud, or securing affected accounts.
It should cover the circumstances of the breach, when it occurred, the personal data involved, likely harm, estimated number of affected people, mitigation steps, whether individuals have been notified, and a contact person for regulatory follow-up.
This article is based on the Nigeria Data Protection Act 2023, the NDPC General Application and Implementation Directive 2025, and the NDPC privacy breach reporting portal.
Hexagon Dataprotect is a professional services firm made up of certified Data Protection Officers (DPOs), cybersecurity professionals, legal experts, and strategic consultants. Our mission is to help organizations and Data Protection Compliance Organizations (DPCOs) achieve, sustain, and scale their compliance with the Nigeria Data Protection Act (NDPA), EU GDPR, and other global privacy standards.
Copyright © 2025 Hexagon DPO - All rights reserved. By Hexagon Dataprotect Limited
