The response clock requires coordinated technical investigation, privacy assessment and accountable records.A personal-data breach creates two urgent problems at the same time. The organisation must contain the security incident, and it must determine whether the event creates a risk that triggers notification under the Nigeria Data Protection Act 2023. Waiting for a perfect forensic report before starting the privacy assessment can waste the most valuable hours.
Section 40 of the NDP Act provides the statutory foundation. Where a breach affecting personal data is likely to result in a risk to the rights and freedoms of individuals, the controller is required to notify the Nigeria Data Protection Commission within 72 hours of becoming aware of the breach. The precise facts matter, and organisations should obtain qualified legal or data-protection advice for a live incident.
First decide whether personal data is involved
A cyber incident and a personal-data breach overlap, but they are not identical. Ask whether personal data was accidentally or unlawfully destroyed, lost, altered, disclosed or accessed. The event may involve confidentiality, integrity or availability. An encrypted payroll database made unavailable can be relevant even without evidence that its contents were copied.
Record when the organisation became aware, what was initially observed and why the event may involve personal data. Awareness should be tied to facts, not delayed by an internal label such as “suspected incident.”
Assess risk to people, not only damage to the company
The notification threshold concerns risk to the rights and freedoms of individuals. A structured assessment should consider:
- the type, sensitivity and volume of personal data;
- whether the data was encrypted or otherwise rendered unintelligible;
- the number and characteristics of affected people, including vulnerable individuals;
- the ease with which people can be identified;
- possible consequences such as fraud, identity theft, discrimination, physical danger, loss of confidentiality or reputational harm;
- whether the data has been recovered, published, sold or accessed by a known unauthorised party; and
- the effectiveness of containment and protective action already taken.
Do not reduce the assessment to a single severity label. Record the evidence considered, uncertainties, decision-maker and reason for the conclusion.
A practical 72-hour workflow
Hours 0–4: contain and establish control
- Activate the incident-response and privacy leads.
- Isolate affected assets where appropriate and preserve volatile evidence.
- Restrict discussion to approved, secure channels.
- Open one controlled incident record and record the awareness time.
- Identify the controller, processors and relevant contracts.
Hours 4–24: establish the facts
- Identify affected systems, data categories, approximate records and people.
- Determine whether data was accessed, altered, lost, disclosed or made unavailable.
- Confirm encryption, backup and access-control conditions.
- Ask processors for documented facts and require prompt escalation under the applicable agreement.
- Begin the risk assessment and identify immediate safeguards for individuals.
Hours 24–48: decide and prepare
- Have the responsible privacy, legal and executive roles review the risk assessment.
- Prepare the Commission notification if the legal threshold is met.
- Draft clear communication for affected individuals where required, focusing on what happened, likely consequences, action taken and steps they can take.
- Coordinate facts across technical, legal, customer-support and communications teams.
Hours 48–72: notify and preserve accountability
- Submit the required notification without waiting for every unknown to be resolved.
- If information cannot be provided at once, document why and provide it in phases without undue delay as permitted by the Act.
- Record the submission, supporting evidence, approvals and next update.
- Continue containment, investigation and support for affected people.
What the notification should be ready to explain
Section 40 calls for information such as the nature of the breach, categories and approximate numbers of data subjects and records, the name and contact details of the data protection officer or other contact, likely consequences, and measures taken or proposed to address the breach. If notification occurs after 72 hours, the controller should provide reasons for the delay.
The organisation should also evaluate whether affected individuals must be informed. Communications should be direct, understandable and actionable. Avoid vague reassurance. Tell people what data and risks are involved, what the organisation has done, and what steps the person should take.
Keep the breach register even when notification is not required
The NDP Act requires controllers and processors to keep a record of personal-data breaches, including the facts, effects and remedial action. This record enables the Commission to verify compliance. A decision not to notify should therefore be supported by a documented risk assessment, not by silence.
A useful breach record includes the timeline, discovery source, systems and data involved, affected individuals, evidence preserved, risk analysis, notification decision, communications, containment, recovery, root cause, corrective actions, owners and review dates.
Prepare before the incident
- maintain a current data and system inventory;
- put breach-escalation duties into processor contracts;
- define the DPO, incident commander and notification approvers;
- prepare decision and notification templates;
- retain reliable logs and evidence sources;
- exercise the process with technical, legal, customer and executive teams; and
- make the NDPC reporting route and current contact details easy to find.
The practical conclusion
The 72-hour period is not only a reporting deadline. It is a test of whether governance, technical investigation and privacy operations can work from one reliable incident record. Organisations that prepare the roles, evidence and decision process in advance can protect people faster and demonstrate accountable judgment when the facts are incomplete.
This educational article is general information and is not legal advice. Consult the NDP Act, current NDPC instruments and qualified advisers for a specific incident.
