Do you in any way collect, process, use, or deal with the personal information (e.g. names, addresses, emails, phone numbers) of others? Do you disclose your personal information to organisations or individuals (“Data Controllers”) in the course of engaging their services? If your answer is yes to one or both questions, you should read on.

A Privacy Policy is a document which discloses how and why Data Controllers collect, use, and share personal information gotten from their customers or clients (“user”, “users”). It is important that all organisations or individuals who collect personal information have a Privacy Policy in place.

In Nigeria, the National Information Technology Development Agency (NITDA) through its Data Protection Regulations 2019 (the “Regulations”) mandates Data Controllers to have a Privacy Policy and write the Privacy Policy in an easy to understand way.

1.Consent – Data Controllers must ensure that personal information is obtained without fraud, coercion or undue influence; and the Privacy Policy must contain a clause stating that the users have consented to the use of their personal information.

2.The kind of information to be collected from users – It is important that the kind of information collected from users and the purpose for which they are collected are expressly listed.

3.The mediums of collecting information – The mediums through which personal information are gathered (e.g. websites, mobile applications) should be stated as well as the technical methods used to collect and store such personal information (e.g. cookies, web tokens).

4.Rights of users to decide how their information should be used – A Privacy Policy should provide the right for users to object to the sharing or use of their personal information for marketing purposes and the right to withdraw from such sharing or use. These rights should cover mediums used for marketing such as voice calls, SMS, and mailing lists.

5. Means of contacting Data Controllers– Users should be able to contact Data Controllers if they have enquiries or complaints about the use of their personal information. Ideally, a phone number and email address should be included.

Yes, any Data Controller who fails to have a Privacy Policy is considered to be in breach of the Regulations. Also, Data Controllers who breach the data privacy rights of any user shall be liable to criminal liabilities as well as monetary liabilities up to 2% of the gross annual revenue of the Data Collector or the sum of ₦10,000,000.00

The user may:

1. make a complaint to NITDA’s Administrative Redress Panel; and

2. enforce his privacy rights in a court of law.