The Nigerian Data Protection Regulation and the Requirement to Conduct a Data Protection and Privacy Audit

Tier 1:

Data Controllers that process the personal data of more than 1000 data subjects in a period of six months, must provide a soft copy of the summary of the audit to the regulatory agency the Nigerian Information Technology Development Agency (NITDA)

Tier 2:

Data Controllers that process the personal data of more than 2000 data subjects in a period of 12 months shall, not later than the 15th of March of the following year, submit a summary of their data protection audit to NITDA (These submissions must be made annually).

In brief, the content of the output of these audits must include the following:

• The personally identifiable information (PII) collected relating to its employees and members of the public (Part of the Record of Data Processing)
• The purposes why the PII is being collected (Legal Basis and Lawful purpose)
• Notices provided to data subjects relating to the collection and use of their PII (Privacy Notices)
• How they allow data subjects update, amend and delete their data (Data Subject Rights)
• Whether they have obtained consent and the methods used to obtain consent from data subjects before their data is processed (Consent Mechanisms)
• Internal and external facing policies and practices implemented by the organisation to protect PII and abide by data protection and privacy requirements (Technical and Organisational Measures)
• Processes and procedures for identifying, monitoring and reporting data protection and privacy related violations (Data Breach Processes)
• Policies and procedures for undertaking data protection and privacy related impact assessments when they introduce new technologies to process PII (Data Privacy Impact Assessments (DPIA))

Section 3.1.8 of the NDPR stipulates that media and society can hold uphold accountable and foster the objectives of this Regulation.

In order to ensure audits are conducted independently and to maintain the integrity of the reports, Data Controllers must obtain the services of a NITDA licenced Data Protection Compliance Organisations (DCPO). The DCPO’s conduct the audit and file the final reports with NITDA who will be able to identify the Data Protection and Privacy posture of the Data Controller.

Impact of the Audit

One of the major impacts of these mandatory audits is that it has led to organisations that have conducted them, being able to identify and make provision for the of gaps to be closed. It has also led to a better awareness and understanding of data protection and privacy requirements.

Organisations that do not conduct these audits are putting themselves at risk of being fined for non-compliance.

Fines for non-compliance are staggered as follows:

1. in the case of a Data Controller dealing with more than 10,000 Data Subjects, payment of the fine of 2% of Annual Gross Revenue of the preceding year or payment of the sum of 10 million naira whichever is greater; and

1. in the case of a Data Controller dealing with less than 10,000 Data Subjects, payment of the fine of 1% of the Annual Gross Revenue of the preceding year or payment of the sum of 2 million naira whichever is greater.

Organisations that do not comply with these requirements will also be putting themselves at a serious competitive dis-advantage when they want to conduct commercial activities such as partnerships, collaborations or processing data on behalf of other organisations.

Due diligence and 3^rd party screening checklists will start to include questions about whether NDPR audits have been undertaken, and what the audit revealed.

If the answer is no audits have been carried out or gaps identified have not been closed, organisations may deem it to risky and move on to other compliant entities.

Conclusion

To conclude, the inclusion of the audit requirement is a bold and innovative step as it not only forces organisations to review and implement measures to comply with the Regulation, it also has the potential for  many organisations once they remediate gaps to be at a high level of compliance within a short but reasonable space of time.

Franklin Akinsuyi

Chief Data Protection & Compliance Officer

Data Analytics Privacy Technology Ltd

Frank can be reached through email:

f.akinsuyi@dapt.com.ng