NDPA 2023 data protection checklist for HR and admin teams

Know what you hold

We have a list of the personal data we hold about staff and applicantsRecords, IDs, bank details, payroll, health and next of kin, and where each is kept: HR system, email, paper files, spreadsheets. We know why we hold each kind of data, and on what lawful basisSuch as the employment contract, a legal obligation (tax, pension), or consent. Sensitive data (health, religion, biometrics) is identified and handled with extra care

Tell people

Staff and applicants receive a privacy noticeWhat you collect, why, who you share it with, how long you keep it, and their rights. Where we rely on consent, we record it and people can withdraw it

Respect people’s rights

A staff member can see and get a copy of the data we hold about them We correct wrong data, and erase data we no longer need, when asked Requests are logged and answered within the time the law allows

Keep it secure

Only the people who need staff data can see itHR, payroll, managers and the books kept apart, each seeing only what their role needs. Access is protected with strong sign-in, ideally a second step We can tell who changed a record, and when Staff files are not passed around in personal WhatsApp or email Data is backed up, and we have tested restoring it

Keep it only as long as needed

We have a retention period for leavers’ and applicants’ records At the end of it we erase personal details, keeping only what the law requires

Be ready for a breach

Staff know how to report a lost phone, laptop or file at once We know when to notify the Nigeria Data Protection Commission (within 72 hours of becoming aware of a reportable breach) and the people affected

Suppliers and transfers

Suppliers that handle our staff data (payroll, HR software, insurance) have a written agreement with us We know whether any staff data leaves Nigeria, and the safeguards for it

Governance

Someone is responsible for data protection, and staff know who We have checked whether we must register with the Nigeria Data Protection Commission, appoint a data protection officer and file compliance audits We assess the risks before starting something new and risky with staff data, such as biometrics or monitoring HR and managers have had basic data protection training

This checklist is a practical starting point written for HR and admin teams, not legal advice. Requirements depend on your company: confirm them with a data protection adviser and the Nigeria Data Protection Commission.

Data protection readiness checklist for HR