Glossary
40 data protection, security and AI terms in plain language.
- Anonymisation
- Processing personal data so that a person can no longer be identified from it, by anyone, by any reasonable means. Truly anonymised data is no longer personal data.
- Breach notification
- Telling the NDPC about a personal data breach that is likely to result in a risk to people, within 72 hours of becoming aware of it, and telling the affected people where the risk is high.
- Compliance Audit Return (CAR)
- The annual report that certain data controllers and processors of major importance file with the NDPC through a licensed Data Protection Compliance Organisation, normally by 31 March.
- Consent
- A freely given, specific, informed and unambiguous indication of a person's agreement to the processing of their personal data. It must be as easy to withdraw as to give.
- Cross-border transfer
- Sending personal data, or allowing access to it, from Nigeria to another country. The NDPA only allows this with adequate protection or another lawful basis set out in the Act.
- Data controller
- The person or organisation that decides why and how personal data is processed.
- Data controller or processor of major importance (DCPMI)
- An organisation the NDPC treats as significant because of the volume or nature of the personal data it processes. It must register with the NDPC and meet extra obligations.
- Data inventory
- A list of the personal data an organisation holds, where it is stored, who can access it and why it is kept. The starting point for most compliance work.
- Data minimisation
- Collecting and keeping only the personal data that is adequate, relevant and limited to what is needed for the purpose.
- Data processing agreement
- A written contract between a controller and a processor that sets out how the processor must handle personal data, including security, confidentiality and breach reporting.
- Data processor
- A person or organisation that processes personal data on behalf of a data controller, such as a payroll provider, cloud service or call centre.
- Data Protection Compliance Organisation (DPCO)
- A firm licensed by the NDPC to train, audit, consult and provide compliance services. Only a licensed DPCO can file a compliance audit return or issue its verification statement.
- Data Protection Impact Assessment (DPIA)
- An assessment carried out before high risk processing begins, to identify risks to people and the measures needed to reduce them.
- Data Protection Officer (DPO)
- The person responsible for advising an organisation on data protection and monitoring compliance. Data controllers of major importance must designate one with expert knowledge.
- Data subject
- The living person the personal data is about, such as a customer, employee, student, patient or beneficiary.
- Data subject request
- A request from a person to exercise their rights, for example to see, correct, delete or move their personal data.
- Encryption
- Turning data into a form that can only be read with the right key. It protects data when it is stored and when it is sent.
- GAID 2025
- The General Application and Implementation Directive issued by the NDPC in 2025. It explains how organisations should apply the NDPA, including registration and audit returns.
- Lawful basis
- The legal reason that allows processing of personal data: consent, contract, legal obligation, vital interests, public task or legitimate interests.
- Least privilege
- A security principle: give each person only the access they need to do their job, and no more.
- Legitimate interests
- A lawful basis that allows processing for a genuine business purpose, as long as it does not override the rights and interests of the people concerned.
- Multi factor authentication (MFA)
- Signing in with two or more proofs of identity, such as a password and a code from a phone. It stops most account takeovers.
- NDPA
- The Nigeria Data Protection Act 2023, Nigeria's main law on personal data. It created the Nigeria Data Protection Commission.
- NDPC
- The Nigeria Data Protection Commission, the regulator responsible for enforcing the NDPA.
- Personal data
- Any information relating to an identified or identifiable living person, such as a name, phone number, ID number, location or online identifier.
- Personal data breach
- A security incident that leads to personal data being accidentally or unlawfully destroyed, lost, changed, disclosed or accessed.
- Phishing
- Fake messages, by email, text or WhatsApp, that trick people into clicking links, sharing passwords or making payments.
- Privacy by design
- Building data protection into systems, products and processes from the start, rather than adding it later.
- Privacy notice
- A clear statement that tells people what personal data is collected, why, on what lawful basis, who it is shared with, how long it is kept and what rights they have.
- Processing
- Anything done with personal data, including collecting, recording, storing, using, sharing and deleting it.
- Pseudonymisation
- Replacing identifying details with codes so data cannot be linked to a person without extra information kept separately. Pseudonymised data is still personal data.
- Purpose limitation
- Using personal data only for the specific purposes it was collected for, and not for unrelated purposes.
- Records of processing (RoPA)
- A register of an organisation's processing activities: purposes, categories of data and people, recipients, transfers, retention and security measures.
- Remedial fee
- The sum the NDPC can order an organisation to pay for breaching the NDPA: up to ₦10 million or 2% of annual gross revenue, whichever is greater, for major importance organisations.
- Responsible AI
- Using artificial intelligence in a way that is lawful, fair, transparent, secure and accountable, with people remaining responsible for decisions.
- Retention schedule
- A list of how long each type of record is kept and when and how it is securely deleted.
- Sensitive personal data
- Personal data that needs extra protection, such as health, genetic and biometric data, religious or political beliefs, ethnic origin and sexual orientation.
- Shadow AI
- Staff using AI tools that the organisation has not approved, often through personal accounts, which can expose personal and confidential data.
- Tabletop exercise
- A rehearsal where a team talks through how it would respond to a scenario, such as a ransomware attack or data leak, to test its plan.
- Vendor risk assessment
- Checking a supplier's security and data protection before and during a contract, because organisations remain responsible for data their suppliers handle.
A
B
C
D
E
G
L
M
N
P
R
S
T
V