# Nigeria Data Protection — Compliance Workflows

## Workflow 1: NDPC Registration
1. Identify whether the organisation is a data controller, data processor, or both.
2. Prepare registration documentation: categories of data subjects, personal data categories, processing purposes, recipients, cross-border transfers, retention periods, and security measures.
3. Submit registration application to the NDPC portal.
4. Pay applicable registration fee based on organisation size.
5. Receive registration confirmation and unique registration number.
6. Schedule annual renewal.

## Workflow 2: DPCO Engagement and Annual Audit
1. Determine if the organisation processes personal data of more than 2,000 data subjects in a 12-month period.
2. If threshold met, identify and engage an NDPC-licensed DPCO.
3. Provide DPCO with access to data processing records, systems, and personnel.
4. DPCO conducts data protection audit covering lawful basis, consent management, security measures, data subject rights handling, cross-border transfers, and breach management.
5. DPCO prepares audit report with findings and recommendations.
6. DPCO files audit report with the NDPC within the prescribed timeline.
7. Organisation implements remediation actions based on audit findings.

## Workflow 3: Lawful Basis Assessment
1. Inventory all personal data processing activities.
2. For each activity, identify the applicable lawful basis under NDPA Section 25.
3. For consent-based processing, verify consent meets requirements (freely given, specific, informed, unambiguous, documented).
4. For legitimate interest processing, conduct and document a legitimate interest assessment (LIA).
5. For sensitive personal data, verify explicit consent or applicable derogation.
6. Document lawful basis determination in the processing register.
7. Review lawful basis when processing purposes change.

## Workflow 4: Cross-Border Transfer Compliance
1. Identify all transfers of personal data outside Nigeria.
2. Check if the receiving country is on the NDPC adequacy whitelist.
3. If no adequacy decision, identify an appropriate safeguard: binding corporate rules, standard contractual clauses approved by NDPC, code of conduct, or certification.
4. If no safeguard available, assess applicability of derogations (explicit consent, contract, public interest, legal claims, vital interests).
5. Conduct transfer impact assessment documenting the legal framework of the receiving country.
6. Implement supplementary measures if the receiving country's protections are insufficient.
7. Record transfer details in the processing register.

## Workflow 5: Breach Response
1. Detect and assess the personal data breach (nature, scope, categories of data and data subjects affected).
2. Notify the NDPC within 72 hours of becoming aware of the breach.
3. Include in notification: breach description, DPO contact, likely consequences, and measures taken.
4. Assess whether the breach is likely to result in high risk to data subjects' rights and freedoms.
5. If high risk, notify affected data subjects without undue delay in clear, plain language.
6. Document the breach in the internal breach register (all breaches, regardless of notification).
7. Conduct post-incident review and implement measures to prevent recurrence.

## Workflow 6: Data Protection Impact Assessment
1. Identify processing activities likely to result in high risk (profiling, large-scale sensitive data, systematic monitoring, new technologies).
2. Describe the processing operation and its purposes.
3. Assess the necessity and proportionality of the processing.
4. Identify and assess risks to data subjects' rights and freedoms.
5. Identify measures to address risks and demonstrate compliance.
6. File DPIA results with the NDPC.
7. Consult the NDPC if residual risks remain high despite mitigation measures.