NDPA Definitions for Beginners – A Clear & Complete Glossary
Share
Why Definitions Matter Under the NDPA
If you’re new to the Nigeria Data Protection Act (NDPA), one of the first hurdles is the legal jargon. Words like “data subject,” “controller,” and “processing” may sound abstract but they matter.
-
Legal clarity: Compliance obligations depend on exact definitions.
-
Roles & scope: Whether you’re a controller or processor determines your duties.
-
Rights enforcement: Citizens (data subjects) can only exercise rights if the definitions apply.
-
Risk management: Misclassifying your role may lead to fines or NDPC sanctions.
-
Global compliance: NDPA definitions align with global standards like the GDPR.
Understanding these definitions is your first step to compliance and protection.
Core NDPA Definitions Every Beginner Should Know
Below is a simplified glossary of the most important NDPA terms, complete with examples.
| Term | Definition (Simplified) | Key Points | Example |
|---|---|---|---|
| Data Subject | Any living natural person whose data is being processed. | Covers individuals, not companies. | A patient in a hospital system. |
| Data Controller | The entity deciding why and how data is processed. | Can act alone or jointly. | A bank collecting customer details. |
| Data Processor | Processes personal data on behalf of a controller. | Must follow instructions. | Cloud provider hosting bank data. |
| Processing | Any operation on personal data: collecting, storing, using, deleting, etc. | Very broad definition. | Sending marketing emails. |
| Personal Data | Any information relating to an identifiable person. | Direct or indirect identifiers. | Name, email, IP address. |
| Sensitive Personal Data | Data needing extra protection: health, biometrics, religion, politics, etc. | Special legal safeguards apply. | Medical records, fingerprints. |
| Consent | Freely given, informed, and unambiguous agreement to process data. | Silence is not consent. | Clicking “I agree” to a privacy policy. |
| Lawful Basis | Legal grounds for processing. | Consent, contract, legal obligation, public interest, etc. | Telecom processing billing data under contract. |
| Anonymisation | Data permanently stripped of identifiers. | Irreversible. | Aggregated statistics with no personal link. |
| Pseudonymisation | Data replaced with fake identifiers but reversible. | Still counts as personal data. | Replacing names with codes in a dataset. |
| DPIA (Data Protection Impact Assessment) | Risk analysis for high-risk processing. | Required for sensitive or large-scale data use. | A fintech testing biometric ID verification. |
Extra Terms Beginners Often Miss
-
Controller/Processor of Major Importance: Large-scale processors meeting thresholds set in NDPA GAID.
-
Storage Limitation: You can’t keep personal data longer than necessary.
-
Accountability Principle: It’s not enough to comply; you must prove compliance.
-
Territorial Scope: NDPA applies to Nigerian data subjects, even if the company is abroad.
Real-World Examples
1. Fintech Startup (KYC Data)
-
Data Subject: Customer opening an account.
-
Controller: The fintech.
-
Processor: Third-party ID verification vendor.
-
Sensitive Data: Biometric verification image.
-
DPIA: Required.
2. Cloud SaaS Provider
-
Controller: SaaS company.
-
Processor: Cloud host.
-
Processing: Storing, backing up files.
-
Consent: Via contract terms.
3. Health Clinic
-
Data Subject: Patient.
-
Personal & Sensitive Data: Medical history.
-
Controller: Clinic.
-
Processor: Diagnostic lab.
-
Lawful Basis: Consent + legal obligation.
-
Anonymisation: Used for research.
Common Confusions
-
Controller vs Processor: Sometimes the same entity can be both.
-
Processing = digital only? No. Paper records count if part of a filing system.
-
Pseudonymised = anonymous? No. Pseudonymised is still personal data.
-
Consent by silence? Invalid.
NDPA vs NDPR: What’s Changed?
-
NDPA (2023) is a law. NDPR (2019) was a regulation.
-
NDPA introduces Controllers/Processors of Major Importance.
-
NDPA expands territorial reach, foreign companies processing Nigerian data are covered.
-
Stronger rights, enforcement, and accountability standards now apply.
How to Apply Definitions in Practice
-
Map your data: Label personal vs sensitive data.
-
Define roles: Clarify controller vs processor in contracts.
-
Check lawful basis: Always know your legal ground.
-
Design valid consent forms: Clear, opt-in only.
-
Run DPIAs: For high-risk projects.
-
Respect rights: Access, erasure, portability requests.
-
Plan retention: Delete data when no longer needed.
FAQ: NDPA Definitions for Beginners
Q1: Is the NDPA applicable to foreign companies?
Yes. Any company processing data of Nigerians, even outside Nigeria, must comply.
Q2: Does NDPA apply to anonymised data?
No — fully anonymised data is out of scope. But pseudonymised data is still covered.
Q3: Can a processor become a controller?
Yes. If it decides the “why” or “how” of data use, it becomes a controller.
Q4: Is consent always required?
No. NDPA also allows other bases: contract, legal obligation, public interest.
Q5: What is a controller/processor of “major importance”?
Entities meeting NDPC thresholds — e.g. large scale or cross-border processing.
