Nigeria NDPR Considerations for Payment KYC

Nigeria's data protection landscape evolved from the Nigeria Data Protection Regulation (NDPR) issued by NITDA in 2019 to the Nigeria Data Protection Act (NDPA) signed into law in June 2023. The NDPA established the Nigeria Data Protection Commission (NDPC) as an independent regulatory body, separate from NITDA.

If you were already compliant with the NDPR, the transition to the NDPA does not require a complete overhaul. The core principles remain the same. But the NDPA introduces clearer definitions, stronger enforcement powers for the NDPC, and more specific requirements around cross-border data transfers.

Key changes that affect KYC processing:

• The NDPC has independent enforcement power, including the ability to impose fines.
• Cross-border transfer provisions are more detailed, with adequacy assessments for destination countries.
• Data Protection Impact Assessments are explicitly required for high-risk processing.
• The definition of sensitive personal data is clarified, and BVN falls squarely within it.

Under the NDPA, sensitive personal data includes biometric data, genetic data, and data revealing health conditions, religious beliefs, or political opinions. The BVN, while technically a number, links to biometric data (fingerprints and facial recognition) held by the Central Bank of Nigeria.

What this means for your code:

• Processing BVN requires explicit consent, not just implied or general consent.
• You must have stronger security measures for BVN data than for general personal data like names or email addresses.
• If a BVN is exposed in a data breach, the regulatory response is more severe than for a name or email leak.

Practical impact: Do not treat BVN verification as just another API call. Treat it as a high-security operation. Get explicit consent with specific language about BVN. Encrypt the BVN in transit and at rest. Delete it from your system as soon as verification is complete. Store only the result.

// bvn-handling.js
async function handleBvnVerification(userId, bvn, firstName, lastName) {
  // 1. Log explicit consent (must happen before API call)
  await logConsent(userId, 'bvn_verification',
    'I consent to verification of my Bank Verification Number (BVN) for identity confirmation.'
  );

  // 2. Call Paystack (BVN is transmitted over HTTPS to Paystack)
  var result = await submitBvnVerification(userId, bvn, firstName, lastName);

  // 3. Store only the result, NOT the BVN
  await db.query(
    'INSERT INTO identity_verifications (user_id, type, status, verified_at) VALUES ($1, $2, $3, NOW())',
    [userId, 'bvn', result.status]
  );

  // 4. BVN variable goes out of scope here - no persistent storage
  return { status: result.status };
}

The NDPA requires a lawful basis for processing personal data. For KYC verification, the two most relevant bases are consent and legal obligation.

Consent: The user explicitly agrees to the verification. This is the most straightforward basis for most Paystack KYC use cases. Get consent through a clear action (clicking "Verify my identity"), not through terms-of-service acceptance.

Legal obligation: If a financial regulation requires you to verify customer identity (anti-money laundering requirements, for example), you can process the data based on legal obligation. You still need to inform the user, but you do not need their consent for the specific processing mandated by law.

Legitimate interest: You might argue that preventing payout fraud is a legitimate interest. This basis is available under the NDPA but requires a balancing test: your interest must not override the data subject's rights. For sensitive data like BVN, consent is the safer approach.

Document your basis. Whatever basis you choose, document it. If the NDPC asks why you are processing BVN data, you should be able to point to either a consent record or a specific legal requirement.

Under the NDPR framework (and continued under NDPA transition provisions), organizations that process personal data of Nigerian individuals above certain thresholds must file a Data Protection Compliance Audit annually.

Who must file: Organizations processing personal data of more than a specified number of Nigerian data subjects. The threshold depends on your classification (data controller of major importance vs. ordinary data controller). Check the current NDPC guidelines for the exact thresholds.

What the audit covers:

• What personal data you collect and process.
• The lawful basis for each processing activity.
• Your data security measures.
• Data subject request handling procedures.
• Cross-border transfer practices.
• Any data breaches that occurred during the audit period.

Who conducts it: The audit must be conducted by a licensed Data Protection Compliance Organization (DPCO). You cannot self-audit. Choose a DPCO registered with the NDPC.

Timing: File within the required period (typically by March 15 for the previous year's processing). Late filing or non-filing can result in penalties.

The NDPA addresses cross-border transfer of personal data more comprehensively than the NDPR did.

When it applies: If your servers are outside Nigeria, every piece of personal data you collect from Nigerian users involves a cross-border transfer. This includes resolved account names, verification results, and any other personal data stored in your database.

Conditions for lawful transfer:

• The destination country has adequate data protection laws (as determined by the NDPC).
• Or you have implemented appropriate safeguards (binding corporate rules, standard contractual clauses).
• Or the data subject has consented to the transfer after being informed of the risks.
• Or the transfer is necessary for the performance of a contract between you and the data subject.

Practical approach: If your infrastructure is on AWS, Google Cloud, or Azure, you likely have data processing agreements with these providers. Review whether those agreements include standard contractual clauses or equivalent protections. Consider hosting Nigerian user data in a region that the NDPC recognises as adequate.

Paystack's role: When you call Paystack identity APIs, Paystack processes the data according to their own data protection policies. Review Paystack's Data Processing Agreement to understand where they process and store data. This is part of your due diligence as the data controller.

The NDPA requires notification of personal data breaches to the NDPC and to affected data subjects.

Timeline: Notify the NDPC within 72 hours of becoming aware of the breach. Notify affected data subjects without undue delay, particularly if the breach is likely to result in high risk to their rights.

What to report:

• Nature of the breach (unauthorized access, data loss, data alteration).
• Categories and approximate number of data subjects affected.
• Categories and approximate number of personal data records affected.
• Likely consequences of the breach.
• Measures taken or proposed to address the breach.

BVN breach escalation: If BVN data was exposed, the severity is higher than a name or email breach. In addition to NDPC notification, consider notifying the Central Bank of Nigeria and advising affected users to monitor their bank accounts and contact their banks.

Build your breach response plan now. Do not wait for a breach to figure out the process. Have a documented plan that your team can follow under pressure.

Your privacy notice (or privacy policy) must clearly describe your KYC data processing. Users should be able to find answers to these questions:

What data do you collect? "We collect your bank account number and bank name to verify your account ownership. We may also verify your Bank Verification Number (BVN) for identity confirmation."

Why do you collect it? "We verify your identity to comply with anti-money laundering requirements and to protect you from unauthorized payouts."

Who processes it? "We use Paystack as our payment processor. When you verify your bank account, Paystack queries your bank on our behalf."

How long do you keep it? "We store your verification status (verified or not verified) for the duration of your account plus [X] years as required by financial regulations. We do not store your raw BVN."

What are your rights? "You can request access to your data, correction of inaccurate data, or deletion of data that is no longer needed. Contact [email] to make a request."

Put this information in plain language, not legal jargon. The NDPA requires that privacy notices be clear and accessible.

Review your Paystack KYC implementation against these requirements.

• Lawful basis documented: Can you point to consent records or a specific legal obligation for each type of identity processing?
• Explicit consent for BVN: Is BVN consent separate from general account verification consent?
• Data minimization: Are you storing verification results, not raw BVNs?
• Encryption: Is personal data encrypted at rest and in transit?
• Privacy notice: Does your privacy policy clearly describe KYC data processing?
• DPCO audit: Have you filed your annual compliance audit if required?
• Cross-border safeguards: If data leaves Nigeria, do you have adequate protection in the destination country?
• Breach response plan: Can you notify the NDPC within 72 hours of a breach?
• Data subject request process: Can you respond to access, correction, and deletion requests within 30 days?
• DPIA: Have you conducted a Data Protection Impact Assessment for BVN processing?

For the cross-jurisdictional view covering Kenya and other African markets, see the data protection duties guide.