Why Nigerian fintechs face a critical window for NDPA 2023 compliance

The Nigeria Data Protection Act 2023 (NDPA 2023) represents the most significant overhaul of data protection law in Nigeria's history. For fintech companies operating in Nigeria, the implications are profound and the compliance window is narrowing rapidly.

The NDPA 2023 establishes the Nigeria Data Protection Commission (NDPC) as the principal regulatory authority, replacing the fragmented framework that existed under the NDPR 2019. The Act introduces mandatory data protection obligations that apply to all organisations processing the personal data of Nigerian residents, regardless of where the organisation is incorporated.

For Nigerian fintechs, the most pressing obligations include: appointing a Data Protection Officer (DPO) where processing is carried out on a large scale, conducting Data Protection Impact Assessments (DPIAs) for high-risk processing activities, implementing technical and organisational measures to ensure appropriate security of personal data, and registering as a Data Controller or Data Processor of Major Importance where applicable.

The financial services sector faces particular scrutiny under the NDPA 2023 because of the sensitivity of financial data and the scale at which fintechs typically process it. Customer KYC data, transaction histories, biometric data used for identity verification, and behavioural data used for credit scoring all fall squarely within the Act's scope.

FortressPoint recommends that Nigerian fintechs prioritise three immediate actions: conducting a data audit to map all personal data flows and identify gaps against NDPA 2023 requirements, updating privacy notices and consent mechanisms to meet the Act's transparency standards, and establishing a breach notification procedure that meets the 72-hour reporting window required under the Act.

Organisations that proactively engage with NDPA 2023 compliance now will be better positioned when the NDPC begins enforcement activity. The cost of remediation after an investigation is invariably higher than the cost of proactive compliance. FortressPoint's GRC team is available to support Nigerian fintechs through every stage of their NDPA 2023 compliance journey.