Handling Customer ID Data Under Nigeria's Data Protection Law: A Practical Checklist

Most conversations about data protection happen in legal documents. But whether you actually comply is decided by ordinary engineering choices. What do you store? For how long? Who can open it? Does your log file quietly keep a copy of everyone's BVN?

This checklist takes the ideas in the Nigeria Data Protection Act (NDPA) 2023 and turns them into things you can do this week. It's written for people who handle identity data such as BVNs, NINs, ID documents and selfies.

A quick note: this is general information, not legal advice. Ask a qualified professional about your own situation.

1. Find out what you actually hold

You can't protect what you haven't mapped. Take an hour and write down two lists.

First, every place identity data comes in: sign-up forms, file uploads, webhooks, even your support team's inbox.

Second, every place it ends up: your database, file storage, backups, analytics tools, emails.

Then mark the sensitive stuff. Government ID numbers and anything biometric (like a face scan) need the most careful handling.

One thing catches almost everyone. The biggest leak usually isn't the database. It's the logs. Error trackers and request logs often save the whole request, including the BVN and the selfie. Strip those out before anything gets logged.

2. Know why you're collecting it, and write it down

For each thing you collect, you need a reason the law accepts. Common ones are a legal obligation, a contract, or the person's consent. For KYC, a legal or regulatory duty is often the right one.

What to do about it:

• Write a privacy notice that says what you collect, why, how long you keep it, and what rights people have.
• If you rely on consent, make it specific and easy to withdraw. A pre-ticked box buried in the terms doesn't count.

3. Collect less

This is the cheapest protection you will ever get. Data you never collected can't leak.

• Ask for a BVN or a NIN depending on risk, not both out of habit. Here's how to choose.
• Once a check is done, don't keep the raw ID photo or selfie unless you have a real reason.
• Keep the outcome instead: verified, the match score, the date, and a reference. That's usually all you need later.

4. Decide how long you keep things, and enforce it

"We'll delete it eventually" isn't a policy. Pick a retention period for each type of data and write it down. Then set up a scheduled job that deletes or anonymises records when time is up, and check that it really runs.

Don't forget backups. Data you deleted from the live system can sit in old snapshots for years.

5. Lock it down

• Use HTTPS everywhere and encrypt your database and file storage.
• Give people only the access they need. Your support team rarely needs to see a full BVN, so show it masked (•••••••8901) by default.
• Never copy real customer data into your test or development environments.
• Keep an audit log of who viewed or exported identity records.
• Keep API keys out of your front-end code and out of your repository.

6. Think harder about biometrics

Face matching and liveness checks deal with sensitive data. Before you add them, write a short note answering a few questions. Why do you need it? Is there a less intrusive way? Who can see the data? How long is it kept? This is what the law calls a data protection impact assessment, and a page or two is a good start.

7. Plan for a breach before it happens

Nobody likes this one, but it's much easier to plan now than to panic later.

• Write down who does what if something goes wrong.
• Make sure you can tell which people's records were affected. This is where storing less data pays off.
• Know that the NDPA expects you to tell the Commission within 72 hours of a serious breach, and to tell the affected people when the risk to them is high.

8. Respect people's rights

People can ask what you hold about them, ask you to correct it, and in many cases ask you to delete it. You need a way to receive those requests (a monitored email address is a fine start) and a way to find and remove one person's data from every place you store it.

9. Check the companies you share data with

Every vendor you send identity data to is a processor, and you're still responsible for what happens to it. Before you sign up, ask:

• Is there a written agreement covering purpose, security and deletion?
• Where is the data processed, and what's the legal basis if it leaves Nigeria?
• Does the vendor keep the data? For how long? Is it used to train anything?

10. See whether you need to register

Organisations that process a lot of personal data are treated as "of major importance," and they have to register with the NDPC. Many also need a Data Protection Officer. Find out where you fall.

How we try to help

We built our verification API so that the checklist gets shorter for you. We store the outcome of an identity check rather than the raw data from the source, unless you opt in. Documents are deleted after processing unless you choose to keep them. Biometric data isn't kept beyond the verification session. And our document OCR runs on our own servers, not through a third-party AI service.

You can read more on the products page, or see how it all fits into a sign-up flow in How to add KYC to your Nigerian app.

Ready to build? Create a free account and try it with a test key.