What NDPA means for a small business website
The Nigeria Data Protection Act 2023 applies to any business that processes personal data of individuals in Nigeria. If a website collects a name, email address, phone number, or any other identifying information through a contact form, enquiry form, newsletter signup, or checkout, that business is processing personal data and is subject to the Act.
The Act requires that processing be lawful, transparent, and limited to a specific purpose. In practice for a small business website, this means three things: collect only what's needed, tell users what you're collecting and why, and let them request access, correction, or deletion of their data.
What a compliant Privacy Policy actually says
A compliant Privacy Policy is not a boilerplate wall of text. It's a short, specific document that answers these questions in plain language:
- What personal data is collected — names, emails, phone numbers, IP addresses, cookies.
- Why it's collected — to respond to enquiries, fulfil orders, send newsletters, or improve the site.
- How long it's kept — and what happens at the end of that period.
- Who it's shared with — email providers, analytics tools, payment processors.
- How users can request access, correction, or deletion — usually an email address.
- What the legal basis is — usually consent (form submission) or contract (order fulfilment).
The trust angle: why buyers notice
Beyond the legal requirement, the Privacy Policy is a trust signal. A serious buyer researching a service provider often checks the Privacy Policy before submitting a form. It's a quick tell: does the business treat data as something it takes responsibility for, or as an afterthought?
A missing or template Privacy Policy reads as unserious. It's the same signal as a missing footer or a broken contact page — it communicates that no one thought carefully about the business's online presence. The trust cost of that signal is higher than the compliance cost of fixing it.
What a privacy page is not
A privacy page is not a legal shield. It doesn't protect a business from the actual obligations of the Act — it documents how the business is meeting them. A copy-pasted template that claims to collect no data while the site runs Google Analytics, Meta Pixel, and a contact form is worse than no policy at all: it's a documented misrepresentation.
The policy needs to be accurate. If it's not, the business is not compliant, regardless of what the page says.
What to do next
If your site collects personal data and has no Privacy Policy, add one. If it has a template policy, audit it against the actual data your site collects. If you're not sure what your site collects, send us the link and we'll map it — the answer is usually more than the owner expects.
Frequently asked
Do I need a Privacy Policy if I'm not ecommerce?
Yes. Any website that collects personal information — through contact forms, newsletter signups, or analytics that capture IP addresses — needs a Privacy Policy under NDPA.
Is a template Privacy Policy enough?
Rarely. Templates often miss what a specific site actually collects, or claim it collects less than it does. The policy needs to reflect the real data flows of the site.
What happens if I don't have one?
Under NDPA, a business that processes personal data without a compliant policy is exposed to regulatory penalties. Beyond the legal risk, serious buyers notice missing privacy policies as a trust signal.
Ifeanyi Ejidike
Creative Director & Lead Engineer, Gravity Concepts
Writes from real client work — branding, print, and production-grade web builds for ambitious businesses.
Want us to handle this for you?
Design, print, web builds, and ongoing maintenance — fast response, direct communication.
