NDPA Breach Notification Timeline (Nigeria): The 72-Hour Rule

A data breach is when personal data is accidentally or unlawfully accessed, disclosed, altered, lost, or destroyed. That covers far more than a hacked database: a staff member emails customer records to the wrong person, a laptop with unencrypted client data goes missing, an AI system exposes personal data in its outputs. All three are breaches.

When it happens (and at some point, it will happen) you need to know what to do, who to tell, and how fast.

Need the practitioner-grade walkthrough? When the 72-hour clock actually starts, three real awareness scenarios with date math, what counts, and the response template I use with clients: 72 Hours, Starting From When? The NDPA Breach Clock Most Teams Misread.

What the NDPA requires

The Nigeria Data Protection Act 2023 requires data controllers to notify the NDPC and affected individuals when a breach is likely to result in a risk to the rights and freedoms of data subjects.

The key elements:

Notification to NDPC. When a breach occurs that poses a risk to data subjects, you must notify the Nigeria Data Protection Commission. The notification should include:

• A description of the circumstances of the breach
• The date or period when it happened, and when you became aware
• What personal data was involved
• An assessment of the likely harm, and an estimate of how many people are at real risk of significant harm
• What you have done to contain and address it
• Whether and how affected individuals have been told
• Your DPO's contact details

That list follows the GAID's own breach-notification article, so filing to it means the NDPC gets what its template asks for rather than a GDPR-shaped summary.

Notification to data subjects. If the breach is likely to result in a high risk to individuals, you must also notify the affected data subjects directly. This notification should:

• Describe the breach in clear, plain language
• Explain the likely consequences
• Describe what you're doing about it
• Provide contact details for further information
• Advise on steps they can take to protect themselves

Documentation. Even if a breach doesn't require NDPC notification, you must document it internally: what happened, what data was affected, what you did about it. NDPC or your DPCO may ask to see this record.

Breach assessment: do I need to notify?

Not every breach requires NDPC notification. The test is whether the breach is "likely to result in a risk" to affected individuals.

Likely requires notification:

• Customer financial data exposed (bank details, payment info)
• Health or biometric data accessed by unauthorised parties
• Login credentials leaked (email + password combinations)
• Large-scale exposure of personal contact details
• Data used for identity theft or fraud
• Children's data involved
• Data of vulnerable individuals compromised

May not require notification:

• Encrypted data breached where the encryption key wasn't compromised
• Internal access by an authorised employee who viewed data outside their role (minor, contained)
• Data that's already publicly available was accessed

Always document, even if you don't notify. The assessment itself, including why you decided notification wasn't required, needs to be recorded.

The first 72 hours

When you discover a breach, the clock starts. If you are inside that window right now and need help with the notification and the response, message us on WhatsApp at +353 89 943 8223 to start a paid engagement fast; the regulatory timeline will not wait for a scheduled meeting. Here's what to do:

Hour 0-4: Contain and assess

1. Stop the breach. If data is still leaking, close the vulnerability. Revoke access. Take the compromised system offline if necessary.
2. Preserve evidence. Don't wipe logs or modify the breached system. You'll need the evidence for investigation and potentially for NDPC.
3. Identify what data was affected. What categories of personal data? How many data subjects? How sensitive is the data?
4. Alert your DPO. If you have a Data Protection Officer, they need to know immediately. They'll lead the assessment and notification process.

Hour 4-24: Full assessment

5. Determine the cause. How did the breach happen? Was it a cyberattack, human error, system failure, or insider action?
6. Assess the risk to data subjects. Based on the type of data and circumstances, what's the likely impact on affected individuals?
7. Decide on NDPC notification. Based on the risk assessment, determine whether NDPC notification is required.
8. Prepare notification content. If notifying, draft the NDPC notification and data subject communications.

One timing point the GAID makes explicit, and it surprises people: where the breach poses a high risk to the people affected, they must be told immediately once you become aware, and that duty runs on its own clock. The NDPC filing has 72 hours; telling your customers does not wait for it.

Hour 24-72: Notify and remediate

9. Submit NDPC notification. If required, notify NDPC with the information outlined above. The NDPC runs a dedicated breach-reporting portal at services.ndpc.gov.ng/breach/, linked as "Report a breach" on ndpc.gov.ng.
10. Confirm affected individuals were told. For high-risk breaches this should already have happened in the immediate phase; verify the communications went out with clear, actionable guidance.
11. Implement remediation. Fix the vulnerability that caused the breach. Enhance controls to prevent recurrence.
12. Brief leadership. Ensure the board and senior management understand what happened and what's being done.

If you also serve EU customers

If the breach affects EU data subjects' data, you have a separate GDPR notification obligation:

• 72-hour notification to the relevant EU Data Protection Authority
• "Without undue delay" notification to affected individuals if high risk
• Separate assessment criteria and notification content

You may need to notify both NDPC and an EU DPA for the same breach. The assessments are separate; a breach that doesn't meet NDPA notification thresholds might still require GDPR notification, or vice versa.

Preparing before a breach happens

The worst time to figure out your breach notification process is during a breach. Prepare now:

1. Incident response plan

Document your breach response process:

• Who is the first point of contact when a breach is discovered?
• Who makes the notification decision? (Usually the DPO)
• Who communicates with NDPC?
• Who drafts and sends data subject notifications?
• Who handles media enquiries?
• What's the escalation path for different severity levels?

2. Breach register

Create a template for recording breaches. Include:

• Date and time of discovery
• Date and time of the breach itself (if different)
• Description of what happened
• Categories and volume of data affected
• Risk assessment
• Notification decision and reasoning
• Actions taken
• Lessons learned

3. Notification templates

Pre-draft notification templates:

• NDPC notification template (fill in the specifics when a breach occurs)
• Data subject notification template (in clear, plain language, free of legal jargon)
• Internal escalation template

Having templates ready saves precious hours during an incident.

4. Contact information

Know who to contact:

• NDPC breach notification channel
• Your DPCO (for ongoing reporting)
• Your DPO (if outsourced, ensure 24/7 reachability)
• Legal counsel
• IT/security team leads
• Insurance provider (if you have cyber insurance)
• Communications/PR team

5. Regular testing

Run tabletop exercises. Present a hypothetical breach scenario and walk through your response process. You'll find gaps before a real breach exposes them.

Common breach scenarios in Nigerian businesses

Phishing attack on staff email. An employee clicks a malicious link, giving an attacker access to their email account containing customer correspondence and attachments with personal data.

Unencrypted device lost or stolen. A laptop, phone, or USB drive containing customer records or employee data is lost or stolen without encryption.

Misconfigured cloud storage. A database or file storage bucket is left publicly accessible, exposing personal data to anyone with the URL.

Insider access. A current or former employee accesses personal data they're not authorised to see, or takes customer data when leaving the company.

API vulnerability. An API endpoint exposes personal data without proper authentication, allowing unauthorised access to customer records.

WhatsApp data leak. Customer conversation data shared in a staff WhatsApp group, or WhatsApp Business account accessed by an unauthorised person.

For each scenario, the response is the same framework: contain, assess, decide on notification, remediate, document.

What NDPC expects

NDPC wants to see that your organisation:

• Has a documented incident response process
• Assesses breaches promptly
• Notifies when required
• Takes remediation action
• Learns from incidents and improves controls

Zero breaches is an unrealistic expectation, and regulators know it. They expect a mature, documented response when breaches occur. The organisations that get in trouble are the ones that didn't know they had a breach, took weeks to respond, or tried to cover it up.

---

Building the framework before the breach: the diagnostic below assesses incident response gaps, notification risk, and what the NDPC would expect to see.