How to Handle NDPR Data Subject Requests for a Nigerian Application

If your Nigerian application collects or processes personal data, you're subject to the Nigeria Data Protection Regulation (NDPR). One of the most important aspects of NDPR compliance is handling data subject requests correctly. Users have rights to access, correct, delete, and port their data-and you have legal obligations to respond. This guide shows you exactly how to handle these requests to stay compliant and build trust with your Nigerian users.

Establish a Clear Data Subject Request Process

Create a documented procedure for handling requests that includes: designated contact points (email, web form, etc.), verification methods, response templates, escalation paths, and record-keeping requirements. Make this process known to your team and easily accessible to users through your Privacy Policy or website.

Verify the Requester's Identity

Before acting on any request, take reasonable steps to verify the person is who they claim to be. This protects against unauthorized access to someone else's data. Use methods proportional to the sensitivity of the data and the nature of the request. Document your verification efforts.

Understand the Different Types of Requests

NDPR grants users several rights: access (right to know what data you have), correction (right to fix inaccurate data), deletion (right to be forgotten), portability (right to get their data in a usable format), and restriction (right to limit processing). Each requires a different response approach.

Respond Within the Legal Timeframe

Acknowledge receipt of requests promptly and provide a substantive response within 30 days. If you need more time for complex requests, you can extend by another 30 days but must inform the requester within the initial period. Track all requests to ensure timely responses.

Handle Access Requests Completely

For access requests, provide: confirmation of processing, copies of personal data, purposes of processing, categories of recipients, retention period, source of data (if not collected directly), and information about any automated decision-making. Format the response clearly and accessibly.

Process Correction Requests Accurately

When users request correction of inaccurate data, verify the inaccuracy, make the corrections promptly, and inform any third parties you've shared the data with (if required). Let the user know what was corrected and when.

Evaluate Deletion Requests Carefully

For deletion requests, determine if you have a legal basis to retain the data. Valid reasons for retention include: compliance with other legal obligations, public interest tasks, legal claims, or archiving in the public interest. If no basis exists, delete the data and confirm deletion to the user.

Facilitate Data Portability Effectively

For portability requests, provide the user's personal data in a structured, commonly used, machine-readable format (like JSON, CSV, or XML). Ensure the data is easily transferable to another controller if technically feasible. Include only data the user provided to you or that you generated from their activity.

Maintain Proper Documentation

Keep records of all data subject requests: date received, type of request, actions taken, date of response, and any communication with the requester. This documentation is essential for demonstrating compliance if questioned by regulators.

Train Your Team on NDPR Requirements

Ensure everyone who handles user data understands: what constitutes a data subject request, how to recognize one, basic verification procedures, and who to forward requests to. Regular training prevents mishandling and builds a culture of privacy compliance.