A privacy policy is not paperwork you write once and forget. It is the plain explanation your customers deserve of what happens to their data.
This is a starting checklist for a small business, not legal advice. Treat it as a first draft to bring to a lawyer, not a finished document.
Why this isn't optional once you collect data
The moment you collect a customer's name, phone number or email, you are handling personal data under Nigeria's data protection law. A website contact form, a delivery address, or a loyalty list all count.
Not having a policy at all is a worse starting point than having an imperfect one you plan to improve.
The basics to state in plain language
Cover these points without legal jargon:
- What you collect. Name, phone number, email, delivery address, payment details, whatever actually applies to your business.
- Why you collect it. To deliver an order, to reply to an enquiry, to send updates a customer signed up for.
- How long you keep it. Even a rough answer, such as "for as long as your account is active", is better than silence.
- Who else sees it. Name any outside company that processes data on your behalf, such as a delivery partner or a payment processor.
- How to contact you about it. A real email address a customer can use to ask a question or request their data be deleted.
Check your own status first
Before finalising anything, work out whether your business processes personal data of more than 200 people in six months. Our explainer on that test covers it in full.
If you cross that line, a basic policy is not the end of your duties. Registration, and possibly a data protection officer, follow on from that status.
What a template cannot do for you
A downloaded template describes a generic business, not yours. If it lists data you don't actually collect, or leaves out data you do, it misleads the very people it's meant to inform.
Edit any template line by line against what your business genuinely does before publishing it.
When to bring in a lawyer
Get a lawyer involved once you handle sensitive data, operate in a higher-risk sector, or cross the major importance threshold. A lawyer can also confirm whether your specific wording matches current Nigerian law, which this checklist does not attempt to do.
Common mistakes
- Publishing a template unedited. Generic language that doesn't match your business is a liability, not protection.
- Naming NDPC as if it approved your policy. NDPC does not certify individual company policies this way.
- Skipping the deletion request process. Customers increasingly ask for this, and having no answer looks worse than a simple one.
- Never revisiting it. A policy written for a website-only business needs updating once you add an app or a loyalty programme.
For the wider set of NDPC duties this checklist connects to, see the SME regulators hub and the government fees tool for costs across agencies.