Nigeria NDPR / NDPA

Nigeria Data Protection Regulation / Act - DPO, data subject rights, breach notification, registration.


Short name	NDPR
Region	Middle East & Africa
Country or scope	Nigeria
Sector	Privacy
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers NDPR

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 7 controls from Safeguard's control catalog for NDPR.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 25: 3 written for NDPR and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`NG-NDPA-SEC` Security of Processing	Controllers and processors must implement appropriate technical and organizational measures to secure personal data against loss, misuse or alteration; verifiable integrity across the software inventory evidences such measures (NDPA 2023, security-of-processing obligation)	Scan
`NG-NDPA-PRIN` Processing Principles Including Accuracy	Personal data must be processed accurately, kept up to date, and limited to its purpose; the same accuracy discipline for the processing environment requires components with complete names and versions (NDPA 2023, data-processing principles)	Scan
`NG-NDPA-BREACH` Breach Notification Readiness	Personal data breaches likely to risk rights and freedoms must be notified to the NDPC within a short statutory window; rapid breach scoping requires known versions across the processing software (NDPA 2023, breach-notification obligation)	Scan
`NG-NDPA-PROC` Engagement of Processors	Controllers may engage only processors providing sufficient compliance guarantees under a binding agreement, requiring visibility into the suppliers behind the processing software (NDPA 2023, processor-engagement provision)	Scan
`NG-NDPA-DPO` Data Protection Officer	Controllers of major importance must designate a data protection officer, providing a reachable accountability contact for the systems described in the SBOM (NDPA 2023, DPO-designation obligation)	Scan
`NG-NDPA-REG` Registration of Controllers of Major Importance	Data controllers and processors of major importance must register with the NDPC with identifying particulars; a uniquely identified, timestamped SBOM supports registration-grade documentation of processing systems (NDPA 2023, registration obligation)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`NDPR-2.1`	Core Data Processing Principles (Art. 2.1)
`NDPR-2.5`	Data Security Obligations (Art. 2.5)
`NDPR-2.6`	Compliance Audit Obligations (Art. 2.6)
`NDPR-3.1`	Data Subject Rights (Art. 3.1)
`NDPR-DPCO-1`	DPCO Registration and Data Controller Registration
`NDPR-XBORDER-1`	Cross-Border Data Transfer Controls
`NDPR-BREACH-1`	Data Breach Notification

Policy templates

Written for NDPR:

NDPR: Privacy Policy Notice
NDPR: Data Subject Rights Procedure
NDPR: Information Security Policy

And 22 from the standard set, adapted to NDPR.