Is Your HR Data Protected? What the Nigeria Data Protection Act Means for Employee Records in 2026

Most conversations about HR compliance in Nigeria start and end with payroll tax. But there's a second compliance obligation quietly tightening around every employer in the country: what you do with your employees' personal data.

What Changed

The Nigeria Data Protection Act (NDPA) has been law since 2023, but it gained real teeth recently. The Nigeria Data Protection Commission issued a General Application and Implementation Directive (GAID) in March 2025, which came into effect in September 2025 and now provides comprehensive, binding guidance on how the NDPA applies across every sector — including employment.

In practical terms: this isn't a law employers can treat as background noise anymore. Employers, in their role as data controllers and processors, are now required to put in place robust security protocols and safeguards for every kind of personal data activity — collection, storage, disclosure, alteration, and retrieval.

What Counts as Employee Data Under This Law

If your HR function touches any of the following, the NDPA applies to it:

• Names, addresses, phone numbers, and national identification details
• Bank account details used for salary payment
• Next-of-kin and emergency contact information
• Medical records or health information tied to leave or benefits
• Performance reviews and disciplinary records
• Biometric data (fingerprint clock-in systems, facial recognition attendance)

That's most of what a typical HR department manages day to day — which means most HR departments have real exposure here, whether they've registered that fact or not.

Where This Gets Risky for Growing Businesses

Larger companies with dedicated legal and IT teams have started building out formal data governance processes. Smaller and mid-sized businesses are the ones most exposed, for a simple reason: employee data in a growing SME is often scattered across places that were never designed to be secure.

Common exposure points:

• Spreadsheets shared over email or WhatsApp — no access controls, no audit trail of who viewed or edited what.
• Personal cloud drives used to store scanned ID documents or bank details during onboarding.
• Paper files in an unlocked cabinet, technically "storage" under the law, with no safeguards at all.
• Former employees' data kept indefinitely with no retention or deletion policy.

None of these are unusual practices — they're how most growing Nigerian businesses have always run HR. But under the current directive, each one is a compliance gap.

What HR Teams Should Do Now

1. Map where employee data actually lives. Most companies are surprised by how many separate spreadsheets, drives, and inboxes hold personal data once they actually look.
2. Restrict access by role. Not everyone in the office needs to see salary or medical information — access should match job function.
3. Set a retention policy. Define how long you keep data after an employee leaves, and actually delete it on schedule instead of accumulating records indefinitely.
4. Centralize onboarding data collection. The more entry points for collecting personal data (forms, WhatsApp, email attachments), the harder it is to secure consistently.
5. Choose HR tools with access controls, not just storage. A shared spreadsheet is storage. It is not security.

Where a Proper HRIS Platform Helps

This is one of the clearest practical arguments for moving off spreadsheets and onto a structured HR platform. QCLOSE HR centralizes employee records — from onboarding documents to payroll and performance data — in one system with role-based access, rather than scattered across personal drives and email threads. For a growing business trying to get ahead of NDPA obligations without hiring a dedicated data protection officer, consolidating records into one properly access-controlled platform is one of the highest-leverage steps available.

Bring your employee data into one secure system. See how QCLOSE HR handles it →