Yes, the Nigeria Data Protection Act 2023 (NDPA) applies to your payroll and HR files. You are the data controller for your employees' personal data, so you need a lawful reason for each item you hold, you must protect it, and you must tell the Nigeria Data Protection Commission (NDPC) and affected staff if it leaks. Small businesses are covered by the principles even where the formal registration duties do not reach them.

Payroll files hold names, addresses, bank accounts, Tax IDs, pension PINs, salaries, next-of-kin details and sometimes health information. That mix makes them an obvious target for fraud. The Act and the regulator's guidance can change, so confirm anything specific with the NDPC or a lawyer.

Who is who under the Act

The rules in plain terms

The Act's principles translate into seven habits for an employer.

  1. Have a reason and say it. For payroll the usual reasons are performing the employment contract and meeting legal duties such as tax and pension law. Tell employees in a short privacy notice what you collect and why.
  2. Use data only for the stated purpose. Bank details collected to pay salary are not for marketing.
  3. Collect only what you need. A payroll file does not need an employee's religion or political views.
  4. Keep it accurate. Correct errors promptly.
  5. Do not keep it longer than needed. Retention periods are covered in our record keeping guide.
  6. Protect it. Limit access and secure storage.
  7. Be able to show how you comply. Write down your decisions.
Comparison of payroll data an employer normally needs, such as name, bank details, Tax ID, pension PIN and salary, against data usually not needed, such as religion or political views.
Collect what payroll needs and nothing more.

Usually not. Data needed to pay salary, deduct PAYE and pension, or comply with the law has its own basis. Consent matters for optional uses, such as putting a staff photo on a public website, and it has to be freely given. Because the employer holds the power in the relationship, consent is a weak basis for core HR processing, so do not rely on a signed consent form to justify things you could not otherwise justify.

Employee rights and registration

Individuals have rights over their data. An employee can generally ask what you hold and why, ask for corrections, object to certain uses and, in some cases, ask for deletion. Name one person to receive requests, verify identity, and reply clearly within a reasonable time. Some data cannot be deleted on request because you must keep payroll and tax records. Say so politely, with the reason.

On registration, the duty to register and to appoint a data protection officer apply to controllers and processors "of major importance" under the NDPC rules, which depends on the scale and sensitivity of the data. A ten-person firm is unlikely to meet that test, but check the current definition with the NDPC rather than assuming. Either way, name a person responsible for data protection. It is cheap and it shows accountability.

Practical security for payroll

Checklist of seven practical payroll data security controls: individual logins, two-step verification, protected files, role-based access, locked devices, tested backups and staff training.
Controls a small employer can put in place this month.

What if a vendor handles our payroll data?

If you use a payroll provider, cloud storage, an HR app or an outsourced accountant, they are processors. Sign a written agreement that says what they may do with the data, the security they must keep, how they report a breach and what happens to your data when the relationship ends. Ask where data is stored and who can access it. Transfers outside Nigeria carry extra conditions, so check the current rules first. If you are weighing outsourcing, see when payroll outsourcing makes sense.

What to do after a data breach

A breach is a security incident that leads to accidental or unlawful loss, destruction, alteration or unauthorised disclosure of personal data. Typical cases are a salary spreadsheet sent to the wrong person, a stolen laptop or a hacked mailbox. Under the Act's breach rules, a controller must notify the NDPC within 72 hours of becoming aware of a breach likely to put people's rights at risk, and must tell affected individuals where the risk is high. Confirm the current procedure with the NDPC.

  1. Contain it. Change passwords, recall emails, disable accounts.
  2. Assess it. Which data, whose, how many people, what harm could follow.
  3. Decide on notification. Write down the reasoning and meet the time limit where it applies.
  4. Tell affected staff in plain language what happened and what to do, such as watching bank activity.
  5. Record the cause and the fix.

Recruitment data and background checks

Candidates are data subjects too. Tell applicants how you will use their CV and how long you will keep it, and do not hold the CVs of unsuccessful candidates indefinitely. If you want to keep them for future vacancies, ask or state a period. Checks on candidates have their own limits, set out in our guide to reference and background checks. Extra care applies to CCTV and biometric attendance. Biometric data is sensitive, so explain the purpose, limit its use and take advice before introducing it.

A short checklist for this month

List the personal data in your payroll and HR files and note the reason for each item. Delete what you do not need. Publish a one-page privacy notice. Review who has access every quarter. Sign data terms with vendors. Set retention periods and a disposal routine. Write a one-page breach plan, name a responsible person and fold the data checks into your annual payroll audit. Pay information should reach only those who need it for their jobs, so do not share salaries across the team.