Do you know that it is not enough to have your business registered with the Corporate Affairs Commission? In fact registering your business is just the starting point and there are a whole lot of other obligations for you to have a successfully business.
Today I will share some data protection obligations every business owner and company should put in place.
1. Obligation on Consent
Consent is one of the grounds in which a company can legally process personal data. However, for consent to be valid, it must be freely given, unambiguous and indicated by a clear affirmative action as silence does not constitute consent. Consent must also be specific and informed. Past consent must be checked for validity and re-obtained where necessary.
2. Obligation To Appoint a Data Protection Officer
The Nigeria Data Protection Act requires every Data Controller to appoint a Data Protection Officer. The Data Protection Officer will be responsible for monitoring the company’s compliance with the relevant laws on data protection and will serve as the primary contact person for the Nigeria Data Protection Commission (NDPC).
3. Obligations On Data Processing Agreements
Section 29(2) of the Nigeria Data Protection Act 2023 provides to the effect that there must be a written data processing agreement between a company which collects the data of their customers (data controller) and third parties which process the customers’ data on behalf of the company (data processor). The NDPA 2023 also imposes a duty on such a company to ensure that third party processors abide by its provisions.
4. Obligation on Data Protection Audit
Every organisation that processes the personal data of at least 1,000 persons within six months or 2,000 persons within a year is required to carry out a data protection audit of its operation and file the audited report with the commission
Failure to file an annual audit report attracts a penalty thus:
• For ‘Data Controllers and Data processors of Major Importance’, a fine equal to 2% of their annual gross revenue of the previous year or a sum of ₦10 million, whichever is greater.
• For ‘Data Controllers and Data Processors Not of Major Importance’, a fine equal to 2% of their annual gross revenue of the previous year or a sum of ₦2 million, whichever is greater.
5. Obligations to Conduct a Data Protection Impact Assessment (DPIA)
Section 28 of the Data Protection Act provides that where the processing of personal data may likely result in high risk to the rights and freedoms of a data subject by virtue of its nature, scope, context, and purposes, a data controller shall, prior to the processing, carry out a data privacy impact assessment.
As a business owner, it is important that you continually monitor the data protection practices of your business to ensure they are compliant with the NDPA 2023 and to avoid penalties.
For advert enquiries call 0813 776 2516.
Send your press release and articles to: hannah@thelegalpreneur.com.ng