Data protection
NDPA obligations alongside an AML/CFT programme
An AML/CFT programme is an intensive personal data processing operation, and Nigeria's data protection regime applies to it. The two are not in conflict, but they do have to be reconciled deliberately — on lawful basis, on retention, on subject rights and on who inside the institution can see a case file.
Who sets the expectation
Nigeria Data Protection Commission (NDPC)
Regulator for personal data processing in Nigeria under the Nigeria Data Protection Act and its subsidiary instruments.
Who this applies to
- The institution, as data controller
- It decides why and how personal data is processed for AML/CFT purposes, and the accountability for those decisions cannot be delegated to a supplier.
- Software and service suppliers, as processors
- Processing on the controller's documented instructions, under a written arrangement, with defined security obligations and sub-processing terms.
- The data protection officer
- Where the institution is required to appoint one, that officer has to be able to review AML/CFT processing — which means having a route into a case file that is compatible with reporting confidentiality.
What it requires
The obligation, stated qualitatively
Each duty below is described in substance — what it requires and what evidence it produces. Thresholds, deadlines, section numbers and penalty provisions are deliberately absent, and where a duty turns on one, the parameter you must read from the operative instrument is named beside it.
Establish a lawful basis, and record it
Processing carried out to meet a statutory AML/CFT duty rests on a different basis from processing carried out for commercial purposes, and the basis determines which subject rights apply and how.
Evidence: A processing record identifying each purpose, its basis and its retention position.
Read from the operative instrument: Which bases are available under the current Act and its subsidiary instruments.
Purpose limitation and minimisation
Data collected for AML/CFT purposes is used for those purposes. The temptation this creates is real: a customer file assembled for due diligence is also the richest marketing dataset the institution holds.
Evidence: Access controls by purpose, and evidence that AML data is not flowing into unrelated processing.
Security of processing
Appropriate technical and organisational measures, proportionate to the sensitivity of the data. Identity documents, ownership structures and investigation narratives sit at the sensitive end of anything the institution holds.
Evidence: Encryption and access control design, an access audit, and evidence of testing.
Data subject rights, reconciled with reporting confidentiality
Rights of access, rectification, erasure, objection and portability apply, subject to the exemptions and restrictions the law provides. Where a right would reveal the existence of a report of suspicion, the confidentiality rule and the data protection rule have to be reconciled — and that reconciliation is a legal determination, made in advance and written down, not a decision taken under time pressure when a request arrives.
Evidence: A documented request-handling procedure, the legal analysis behind any restriction applied, and a record of each request and its outcome.
Read from the operative instrument: Which exemptions apply, and the period within which a request must be answered.
Retention, and its collision with record keeping
Data protection requires that personal data is not kept longer than necessary; AML record keeping requires retention for a prescribed period. The resolution is a retention schedule that states the basis per record category, not a single institution-wide default.
Evidence: The schedule, its legal basis per category, and evidence it is enforced.
Read from the operative instrument: The AML retention period, the data protection storage limitation position, and how the institution reconciles them.
Legal holds that survive an erasure request
Where records are relevant to an investigation or a request from an authority, routine deletion has to stop, and the hold has to be able to override an erasure request lawfully.
Evidence: A hold register, and evidence that a scheduled purge refuses held records rather than skipping them silently.
Cross-border transfers
Transfers outside Nigeria need a lawful transfer mechanism. For AML software this is mostly a deployment question: where the data lives, where support staff sit, and which sub-processors are involved.
Evidence: A transfer record per flow, the mechanism relied on, and a sub-processor register.
Read from the operative instrument: The available transfer mechanisms and any registration or filing they require.
Breach notification
A personal data breach must be assessed and, where the threshold is met, notified to the regulator and potentially to affected individuals.
Evidence: An incident procedure, an assessment record per incident, and the notifications made.
Read from the operative instrument: The notification threshold, the recipients and the time limit.
Registration and accountability duties
Organisations meeting the criteria the regime sets carry additional duties, which may include registration with the regulator, appointing a data protection officer and filing periodic returns.
Evidence: The registration record and the filings made.
Read from the operative instrument: The criteria that bring an organisation into the enhanced category, and the duties that follow.
How the platform supports it
Capability, and the control it traces to
Each row below describes behaviour the product documentation records, and carries the identifier of the control-register row it traces to, so a claim can be checked rather than taken on trust.
- Field-level encryption and blind indexingCustomer identifiers and document data are encrypted or blind-indexed by design, so an identifier remains searchable without being stored in queryable plaintext.Control C-05
- Sensitive-access auditAccess to personal data is recorded in an append-only per-tenant audit chain with verifiable anchors, which is what makes an access review something other than an assertion.Control C-16
- Retention policy and legal holdsRetention policies and legal holds are modelled explicitly, and a purge that would remove held records is refused rather than silently narrowed. The control register records this control as pending a legal decision: the mechanism is built, the periods and their bases are the institution's determination to make.Control C-17
- Tenant isolation and deployment choiceTenant context is resolved before request handling and tenant tables carry enforced row-level security, and the deployment model determines where data physically sits — which is the practical answer to most transfer questions.Control C-01, C-18
- Sub-processor and provider governanceExternal providers are expected to carry contracts, data-use terms, timeout and retry policy and failure evidence; the register of who processes what, and where, is maintained rather than assumed.Control C-22
- Incident handling that preserves evidenceIncident procedures preserve evidence, notify required parties and track corrective actions to completion — the operational half of a breach notification duty.Control C-24
What we do not claim
On a compliance product the absence of a claim is information a buyer needs as much as the presence of one.
- We do not state the current retention period for AML records, the breach notification threshold or the deadline for answering a data subject request. Those are legal determinations for the institution and its advisers.
- We are not registered, certified or approved by the NDPC as a data protection compliant product, and no such status is claimed.
- The retention and legal hold control is recorded in our own control register as pending a legal decision. We would rather publish that than imply the question is settled.
Verify before you rely on this page
This page states obligations qualitatively and carries no figures. Before acting on anything here, confirm the following against the instrument currently in force for your licence category — and record the date you checked it.
- The current text of the Act and its subsidiary instruments, and whether any of the obligations above have been amended.
- The lawful bases available for AML/CFT processing, and the institution's documented choice for each purpose.
- The exemptions or restrictions that apply to subject rights where reporting confidentiality is engaged.
- The AML record retention period and its reconciliation with storage limitation.
- The breach notification threshold, recipients and time limit.
- The available cross-border transfer mechanisms and any filing they require.
- Whether this institution meets the criteria for enhanced registration and officer-appointment duties.
Related reading
Talk to a specialist
Reconcile AML retention with data protection before it is tested
Bring your data protection officer. The interesting conversation is where the two regimes pull against each other, and it is better had in advance.