Most businesses think about a data breach as a technical event to fix. Under the Nigeria Data Protection Act, it's also a legal clock that starts running the moment you become aware something happened, whether or not you've finished figuring out what actually went wrong.
If you don't know what that clock requires, the time to find out is before an incident, not during one.
What actually counts as a breach
A data breach isn't limited to a dramatic hack. It covers any incident resulting in the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. That includes a lost laptop with client files on it, an email sent to the wrong recipient, a staff member accessing records they had no reason to see, or a compromised WhatsApp Business account (see our guide to WhatsApp account security) being used to extract customer information. None of these require a sophisticated attacker to count.
The 72-hour clock
Once you become aware of a breach that's likely to pose a risk to the rights of the people whose data is involved, you're required to notify the NDPC within 72 hours. "Becoming aware" is the trigger, not "having fully investigated," which is exactly why a plan that exists before an incident matters more than one you try to write during it.
Waiting until you have a complete picture of the breach before notifying anyone is the most common mistake. The 72-hour window is measured from awareness, not resolution. A preliminary notification with the facts you have, followed by updates as the picture develops, is the compliant approach, not silence until everything is confirmed.
When you also have to tell the affected people directly
Beyond notifying the regulator, if the breach is likely to result in a high risk to the rights and freedoms of the individuals involved, the data controller must inform those individuals directly, and promptly. This is a separate obligation from the NDPC notification, and it applies based on the severity to the person, not the size of the business or the breach.
The NDPC notification protects the regulatory relationship. Telling the affected person directly protects the actual human being whose information is now at risk, and it's the step businesses are most tempted to skip to avoid an uncomfortable conversation.
What "high risk" looks like in practice: exposed financial details, government ID numbers, or information that could enable identity theft or financial fraud against the individual, generally clears this bar. A narrower, low-impact exposure may not, but that judgment call is exactly the kind of thing worth getting a second opinion on in the moment, not guessing alone.
The part almost nobody mentions: the breach register
Beyond the notifications themselves, data controllers are expected to keep a breach register, a running record of data breaches that includes what happened, its causes, and the remedial steps taken. This isn't paperwork for its own sake. It's the evidence that you actually have a functioning process, not just a policy document that sounds good until something goes wrong.
The annual compliance audit
Separately from breach response, businesses that meet the relevant thresholds are expected to conduct an annual Data Protection Audit, carried out through a licensed Data Protection Compliance Organisation (DPCO), with the resulting report filed with NITDA. This is the mechanism that turns "we have a privacy policy" into something a business can actually demonstrate, rather than just assert, if ever asked. See our guide to NDPC registration thresholds for whether this applies to your business specifically.
A breach response plan, in practice, before you need one
- Know who's responsible for making the call. Someone in your business needs to be the person who decides "this counts as a breach and the clock has started," before an actual incident forces that decision under pressure.
- Have a notification template ready, covering what you know so far, even incomplete, rather than trying to draft one from scratch inside the 72-hour window.
- Keep the breach register as a living document, not something created retroactively after the first real incident.
- Know your DPCO or compliance contact in advance, rather than searching for one for the first time during an active incident.
- Decide your direct-notification threshold ahead of time, so "is this high risk to the individual" isn't a debate happening for the first time while the breach is still unfolding.
Does the 72-hour rule apply even to a very small business?
Yes. The notification obligation is tied to the nature and risk of the breach itself, not the size of the business experiencing it.
What if we're not sure whether an incident is serious enough to count as a reportable breach?
Treat genuine uncertainty as a reason to get advice quickly, not a reason to wait. The 72-hour window doesn't pause while you deliberate, and a cautious notification is far less costly than a missed one.
Is the breach register something the NDPC checks proactively, or only after an incident?
It functions as ongoing evidence of your compliance process and is exactly the kind of record that matters most during an audit or an investigation following a reported incident, which is why it needs to already exist by the time anyone asks for it.
Building the plan before the incident, not during it
The businesses that handle a data breach well are never the ones improvising a response under a 72-hour deadline for the first time. They're the ones who worked out who decides, what gets documented, and who gets called, before anything went wrong. Awal Global Consults helps businesses put that plan together in advance, alongside the broader NDPA compliance review most businesses are still missing.
Need help with this?
Awal Global Consults helps businesses build an actual breach response plan before they need one, rather than figuring it out during an active incident.