A practical privacy operations system for a growing Nigerian business
Share
Published
A growing business needs a repeatable way to answer four questions about customer information: where it is, why it is needed, who can use it and what happens when it is no longer needed. A privacy policy cannot answer those questions on its own. The answers have to survive a busy sales day, a staff departure and a change of software.
For a Nigerian business, the starting point is the Nigeria Data Protection Act 2023 and guidance from the Nigeria Data Protection Commission. The Commission’s published privacy policy describes purpose limitation, minimisation, retention, security and accountability among its operating principles. The practical system below translates those concerns into work a small team can assign and check. It is an operating proposal, rather than a certification of legal compliance.
Follow one order before mapping the whole company
Imagine a small furniture seller taking an order through a website and arranging delivery through a courier. A customer’s details might appear in the order system, a payment confirmation, a dispatch spreadsheet, a staff conversation and a printed label. Counting software subscriptions would miss some of those copies.
Choose one completed order and trace its path with the people who handled it. Use a test order or masked record for the review. Ask the salesperson to show the collection form, the dispatch officer to explain the courier handover, and the accounts lead to identify the record needed for reconciliation. Record uncertainty instead of filling a gap with an assumption.
The output should be a short register of information flows. Our worked customer-data register shows how to build one without turning the register itself into another customer database.
Give each record an owner and a decision
Ownership means someone can explain and approve the handling of a record. It does not mean that person has unrestricted access to every customer detail. A dispatch lead may own the delivery process while an accounts colleague controls financial records.
| Operating question | Evidence to keep | Person to assign |
|---|---|---|
| Why do we collect this field? | A specific business purpose and the relevant legal review | Process owner |
| Who receives it? | Named internal roles and external recipients | Service owner |
| Who can approve access? | An approval record and a way to remove access | System owner |
| When do we review retention? | A documented rule, exceptions and a review date | Records owner |
| Who handles a request or incident? | A monitored route and a deputy | Privacy lead |
One person may hold several roles in a very small company. Write down which responsibility they are exercising. A deputy matters when the owner is travelling or unavailable.
Put an approval step where information leaves
The most useful review point is often a handover: sending a list to a courier, uploading a file to a new tool, giving a contractor access or publishing an event page. Staff should know what information the recipient needs and how to verify the destination.
For the furniture order, a courier may need delivery details while a marketing contractor has a different purpose. Do not copy the same master spreadsheet to both simply because it already exists. Create the appropriate view or export, and check that unnecessary columns and hidden sheets have been excluded.
Use the existing access-control guide for Nigerian SMEs to review who can approve those exports. Where the handover involves a supplier, agree the return and deletion arrangements before the relationship ends; the vendor exit guide explains that discussion.
Include paper and physical handovers in the review. A reception visitors’ book can expose earlier entries, while a discarded parcel label can leave the premises with customer details. Recruitment has its own handover decisions: agree the timing and scope of a reference check before contacting someone’s current employer.
Make requests and incidents easy to report
A customer may ask for a correction in an ordinary support message. An employee may notice that a file went to the wrong recipient. Neither should depend on knowing a specialist legal phrase or finding the one staff member who understands privacy.
Provide a monitored address or support route, tell staff what to escalate and record who covers absences. Separate the request record from the customer information needed to fulfil it. A broad shared inbox should not become a collection of identity documents.
The privacy-request inbox checklist sets out an intake and handover process. An incident needs a different response route, including technical support and a decision on any notification obligations. Practise that route with the 45-minute tabletop exercise before a real event.
Use a first-month implementation plan
In the first week, select one customer process, name its owner and document the handovers. In the second, examine the collection fields and access list. Ask which details are necessary, which permissions are temporary and which copies nobody can explain.
Use the third week to test one privacy request and one supplier handover with fictional records. During the fourth, review the findings and assign fixes. This is a suggested work sequence, not a statutory deadline or a promise that a month completes a compliance programme.
Keep a small action register with the issue, affected process, responsible person, due date and evidence of closure. “Review permissions” is incomplete as an action. “Remove the former contractor’s dispatch access and record the test result” gives the owner something concrete to check.
Measure whether the process works
Useful measures include whether requests reach the right owner, whether a sample former employee has lost access, whether a supplier export contains the expected fields and whether a scheduled record review actually happens. A count of policies written tells you less about those outcomes.
Run a short review after a new service, contractor or collection form is introduced. A small operating system is easier to maintain when changes enter it as they happen, rather than waiting for an annual document exercise.
New services also create reasons to revisit the register. The European Commission’s current work on advertising libraries and its published age-assurance study illustrate different transparency and information-flow questions. These European developments have their own scope; they do not themselves impose a new Nigerian requirement on every small business.
Can a spreadsheet be enough?
A carefully controlled spreadsheet can be a starting point for a modest register and action list. Its suitability depends on the work, sensitivity, access controls and team size. Keep descriptions of data in the register; keep the actual customer records in their approved systems.
Does this remove the need for professional advice?
No. A business still needs to determine its applicable obligations, lawful bases and sector requirements. The value of this operating system is that the person giving that advice can work from an accurate description of what the business actually does.
Featured image: AI-generated conceptual illustration.
