NDPA for Small Business: Customer Data and AI in Nigeria

Your phone is full of customer data. There are WhatsApp chats with home addresses, a notebook of names and numbers for "pay later" customers, and a broadcast list of 300 people. Now you also paste customer messages into AI tools to help you reply faster.

Nigeria has a law about all of this: the Nigeria Data Protection Act 2023, or NDPA. This guide explains what the NDPA means for a small business: what counts as customer data, when you need permission, whether you must register, and how to use AI without leaking anyone's details. It ends with a 10-point checklist.

This is a practical guide, not legal advice. For your exact situation, speak to a lawyer or a data protection compliance organisation (DPCO), a firm licensed by the government to help businesses follow this law.

In short:

• The NDPA applies to almost every business that keeps customer names, phone numbers or addresses, including small shops that sell on WhatsApp.
• Only collect what you need, tell customers why, get clear permission for marketing, and keep the data safe.
• Some small businesses must register with the NDPC (the lowest fee is ₦10,000 as of October 2026), especially if they handle data of more than 200 people in six months. Check your position before you assume you are exempt.
• Never paste customer names, phone numbers, account numbers or BVNs into AI tools. Remove them first.

NDPA small business basics: the law in plain words

President Bola Tinubu signed the NDPA into law on 12 June 2023, as KPMG Nigeria's summary of the new law explains. In simple terms: if you collect information about people, treat it fairly, keep it safe and use it only for the reason you collected it.

The law created the Nigeria Data Protection Commission (NDPC), the government body that makes the detailed rules, receives complaints and can fine businesses. You can find its notices on the NDPC website.

In March 2025, the NDPC issued the General Application and Implementation Directive (GAID), a set of detailed rules on how to apply the law. It took effect on 19 September 2025 and replaced the older Nigeria Data Protection Regulation of 2019, according to this business guide to the GAID on Mondaq. You can read the full GAID on the NDPC website. As of October 2026, the NDPA and GAID together are the main rules.

The law calls you a data controller: the business that decides why and how customer data is used. Anyone who handles the data for you, such as a delivery company or accountant, is a data processor.

What counts as personal data

Personal data is any information that can identify a living person. For a small business, that means customer names, phone numbers, WhatsApp chats, delivery addresses, Instagram handles, bank account numbers, BVN (Bank Verification Number, the number linked to all of a person's bank accounts) and NIN (National Identification Number), customer photos (such as salon "before and after" pictures) and staff records.

Some data is sensitive personal data, which needs extra care. The NDPA lists things like health information, religious beliefs, ethnic origin, political views and sexual orientation, as this overview of the NDPA's key provisions sets out. A pharmacy that records which customer buys which medicine is handling health data.

The habits the NDPA expects from you

Principles are the basic rules the law is built on. In everyday terms, they are: be open about what you collect and why, use data only for the reason you gave, collect only what you need (a food vendor needs a name, number and address, not a BVN), keep records accurate, delete what you no longer need, and keep it safe.

Consent: when you need permission

Consent means the customer clearly agrees to how you will use their data. Under the NDPA, consent must be freely given, specific, informed and clear. Silence or a pre-ticked box does not count. The customer can also withdraw consent at any time.

You do not always need consent. The law allows other legal reasons, such as needing the data to complete a sale the customer asked for. If someone orders jollof rice for delivery, you can use their address to deliver it.

You do need clear permission for:

• Adding people to your WhatsApp broadcast list or SMS promos
• Posting a customer's photo or video on Instagram or your status
• Sharing their details with another business
• Using sensitive data, such as health information

A simple consent message on WhatsApp could read:

Thank you for your order! Would you like to receive our weekly price list and promos on WhatsApp? Reply YES to join. You can reply STOP any time.

Keep the reply. That chat is your proof.

Worked example: Chika's provisions shop in Enugu

Take Chika, who runs a small provisions shop in Ogui, Enugu, as an illustrative example. She has 450 customer numbers saved from years of phone orders. She wants to send a December promo.

Instead of blasting all 450 numbers, Chika sends the consent message during normal chats over two weeks. 210 reply YES. She labels them "Promo OK" in WhatsApp Business and broadcasts only to that group. When a customer replies STOP, she removes the label the same day.

Her list is smaller, but everyone on it wants her messages, and she is following the law. Our guide to setting up WhatsApp Business to reply customers faster shows how labels work.

Do you need to register with the NDPC?

Not every business must register. The NDPA requires registration only for data controllers and processors of major importance, a legal label for organisations that handle a lot of personal data or data that matters to the economy or national security.

The NDPC's updated Guidance Notice (dated 19 December 2024) sets out who counts. It is printed in full as Schedule 7 of the GAID on the NDPC website. It sorts these organisations into three levels, each with its own registration fee:

Level	Who it covers (simplified)	Registration fee
Ordinary High Level	Data of more than 200 but under 1,000 people within six months; also schools, primary health centres, independent labs and hotels with under 50 rooms	₦10,000
Extra High Level	Data of 1,000 to 5,000 people within six months; also government agencies, microfinance banks, universities and hospitals	₦100,000
Ultra High Level	Data of more than 5,000 people within six months; also banks, telecom companies, insurers, fintechs and payment companies	₦250,000

These fees are as listed in the GAID, as of October 2026. The same notice also lists some businesses that are not of major importance. These include traders with fewer than 15 staff, and artisans who keep only routine records such as phone contacts, receipts and addresses.

So which rule applies to a busy WhatsApp seller with 15 staff or fewer? The two rules overlap, and the notice does not settle every case. A small shop that only keeps phone contacts and receipts is probably not of major importance. A business that keeps a proper customer database, sells online to many people or handles health data may need to register. Confirm your level and the current fee on the NDPC website before you pay anything, and only pay through official channels.

What about the yearly audit (CAR)?

A Compliance Audit Return (CAR) is a yearly report, prepared with a licensed DPCO, showing how a business protects personal data. Under Article 9 of the GAID, the Extra High and Ultra High levels file a CAR every year. The Ordinary High level renews its registration every year instead and does not file a CAR.

The usual CAR deadline is 31 March. For the 2025 audit year, the NDPC extended it to 30 May 2026, as OAL's regulatory update reported. Most small shops will not file a CAR, but a busy online store or clinic with more than 1,000 customers in six months should check.

What happens if you break the rules

The NDPC can investigate complaints and issue fines. According to Templars' guide to the NDPA enforcement framework, the maximum is the higher of ₦10 million or 2% of annual gross revenue (your total sales for the year before costs) for organisations of major importance, and the higher of ₦2 million or 2% for others. The NDPC can also order a business to compensate affected customers.

A data breach is when personal data is lost, stolen or exposed, such as a stolen phone holding your customer list. If a breach is likely to put people at risk, the business must report it to the NDPC within 72 hours of finding out, as this explainer on breach duties under the NDPA describes. Where the risk to customers is high, you must also tell them.

Using AI tools without leaking customer data

AI tools are apps that write text when you type a question or instruction. Tools like ChatGPT, Gemini, Claude and Meta AI help you draft replies and captions. If you are new to them, start with our practical starter guide to AI for small businesses. The data risk is simple: whatever you paste into an AI tool leaves your phone and goes to the company that runs it.

Follow these rules:

• Remove names, phone numbers and addresses before you paste a customer message. Write "Customer A" instead.
• Never paste BVNs, NINs, account numbers, card details or passwords. No AI task needs them.
• Never upload your full customer list to an AI tool. Remove personal details first, or work with totals only.
• Check the training setting. Many AI apps let you choose whether your chats help train their models. In ChatGPT, as of October 2026, it is the "Improve the model for everyone" switch under Settings, then Data controls, as OpenAI's help page on data controls explains.

Here is a safe way to ask AI for help with a complaint:

A customer wrote: "I paid since Monday and my order never reach. This is not fair." The facts: the rider had a breakdown and the order will arrive tomorrow by 12pm. Write a polite apology under 60 words and offer free delivery on the next order.

No name, no number, no address, and the AI still writes a good reply. Find more safe prompt ideas in our list of ready-to-use AI prompts for business owners.

What the GAID says about AI

Article 43 of the GAID treats AI as an "emerging technology". Organisations that use AI to process personal data are expected to do a data protection impact assessment (DPIA), according to this Mondaq summary of the GAID's AI rules. A DPIA is a written check of what could go wrong and how you will prevent it. Larger organisations file it with their CAR.

For a shop that only uses AI to draft captions with no customer details, this is a small job. If you set up an AI chatbot that reads customer chats or orders, write down what data it sees and how it is protected, and ask your provider the same.

Your 10-point NDPA checklist

1. Write a list of the customer and staff data you keep and where it is stored.
2. Delete anything you do not need, such as old addresses and copies of IDs.
3. Add a short privacy note to your WhatsApp profile, Instagram bio link or website: what you collect, why, and how to contact you.
4. Ask for clear consent before adding anyone to a broadcast or promo list, and keep the replies.
5. Ask before posting any customer's photo or video.
6. Make it easy to opt out, and remove people the same day they ask.
7. Turn on a screen lock and two-step verification (a second code needed to log in) on every business phone and account. Remove staff access the day someone leaves.
8. Never paste personal details into AI tools; remove names, numbers and addresses first.
9. Count roughly how many customers' details you handle in six months, then check the NDPC website to confirm whether you must register.
10. Write a simple plan for a lost phone or hacked account: who to call, what to change, and how to report to the NDPC within 72 hours if customers are at risk.

Mistakes to avoid

• Posting delivery screenshots that show addresses. Blur personal details before you post proof of delivery.
• Asking for BVN or NIN when you do not need it. Let customers give it directly to a payment provider that needs it.
• Paying agents who promise "NDPC registration". Confirm requirements and fees on the official NDPC website first.
• Assuming "small" means "exempt". Some small businesses must register, and every business still has the basic duties of fairness, consent and safety.

Frequently asked questions

Does the NDPA apply to a small business that only sells on WhatsApp?

Yes. If you collect customer names, numbers or addresses, you are handling personal data, and the basic NDPA duties apply. Registration is a separate question. It depends on how much data you handle, what kind it is and how you store it.

Do I need a data protection officer?

A data protection officer (DPO) is a person responsible for data protection in an organisation. The NDPA requires them mainly for organisations of major importance. Even if the law does not require one, name one person in your business to be in charge of customer data.

How much does NDPC registration cost?

As of October 2026, the GAID lists a registration fee of ₦10,000 for the Ordinary High level (renewed every year), ₦100,000 for Extra High and ₦250,000 for Ultra High. The two higher levels also pay a fee when they file their yearly CAR. Confirm the current fee on the NDPC website and pay only through official NDPC channels.

Can I use ChatGPT or Meta AI with customer messages?

Yes, if you remove personal details first. Paste the message without names, numbers or addresses, and never paste BVNs, account numbers or health details linked to a person.

Words to know

• NDPA: the Nigeria Data Protection Act 2023, the main law on personal data.
• NDPC: the Nigeria Data Protection Commission, the government body that enforces the NDPA.
• GAID: the General Application and Implementation Directive 2025, the NDPC's detailed rules for applying the NDPA.
• Personal data: any information that can identify a living person.
• Data breach: when personal data is lost, stolen or exposed.
• CAR: Compliance Audit Return, a yearly data protection report some organisations must file.
• DPCO: data protection compliance organisation, a firm licensed by the NDPC to help businesses follow the law.
• Consent: clear permission from a customer to use their data in a stated way.

Next step

Today, do points 1, 4 and 7 on the checklist: list your data, send your first consent message and turn on two-step verification. Then read more practical guides in our AI for business section, and see our free AI tools for small business to pick tools you can trust.