Corporate training Guides Data protection training by country
Nigeria Data Protection Act (NDPA) 2023: a staff training guide for employers
The Nigeria Data Protection Act 2023 (NDPA) places clear duties on every organisation that processes personal data, and the Nigeria Data Protection Commission (NDPC) is actively enforcing them. Trained staff are your first line of compliance.
What the NDPA asks of employers
The NDPA established the Nigeria Data Protection Commission and sets principles for processing personal data: lawfully, fairly and transparently, for specified purposes, accurately, for no longer than necessary, and securely. The NDPC's General Application and Implementation Directive (GAID) 2025 explains in more detail how the Act applies in practice.
Data controllers and processors must put in place appropriate technical and organisational measures to protect personal data. Where a breach is likely to put people's rights and freedoms at risk, the NDPC must be told within 72 hours, and the people affected must be told promptly where the risk is high.
Data controllers of major importance
Organisations the NDPC classes as data controllers or processors of major importance must register with the Commission, appoint a data protection officer and meet additional obligations. Banks, telecoms operators, insurers, hospitals, schools and large employers are among the organisations most likely to fall into this category.
Fines
For a data controller or processor of major importance, the NDPA allows a penalty of up to the higher of ₦10 million or 2 per cent of annual gross revenue in the preceding financial year. For others, it is up to the higher of ₦2 million or 2 per cent. The NDPC has already fined and investigated organisations, including large companies.
What NDPA training for staff should cover
- What personal data and sensitive personal data are, with examples from your business
- The principles of the Act and the rights of data subjects, in plain language
- Safe handling of customer and staff records, including on WhatsApp, email and shared drives
- Phishing, BVN and SIM-swap scams, fake payment requests and other routes to a breach
- How to report a suspected breach fast enough to meet the 72-hour rule
- Using AI tools without putting personal data into them
Delivery, records and the ITF
Paleon Training delivers NDPA-focused cybersecurity training in-house at your offices, live online or hybrid, across Lagos, Abuja, Port Harcourt and the rest of Nigeria. We provide attendance records, which give you evidence of the measures you took and can also support an ITF reimbursement claim.
Related training programmes
- CyberSecure Workforce: Programme details
- AI Workflow Productivity & Process Transformation: Programme details
Frequently asked questions
Is staff training required under the NDPA?
The NDPA requires appropriate technical and organisational measures to protect personal data. Training staff who handle personal data is one of the most important organisational measures, and the NDPC expects organisations to be able to show what they have done.
Does the NDPR 2019 still apply?
The NDPA 2023 is now the main law. The NDPC's GAID 2025 explains how the Act applies; older instruments apply only where they are consistent with the Act. Check current NDPC guidance for your organisation.
Can the training be delivered at our offices?
Yes. In Nigeria we deliver in-house at your offices, live online or as a hybrid, so you can train teams in several locations.
Is this guide legal advice?
No. It is general guidance, not legal advice. See the NDPC's guidance or take legal advice on your organisation's obligations.
Published 09/11/2026 by Paleon Training Limited. General guidance, not legal advice.
Talk to us about training your teams
Paleon Training runs corporate AI and cybersecurity training for organisations in Nigeria. Start with the free readiness check, or book a consultation and we will recommend a format for your organisation.