NDPR Compliance for Nigerian Schools: What You Are Legally Required to Do With Student Data

The risk schools are quietly carrying

The Nigeria Data Protection Regulation (NDPR) and the broader Nigeria Data Protection Act now apply to any organisation that handles personal data of Nigerian residents — and schools handle some of the most sensitive personal data in the country: minors' biometrics, medical information, family contact details, financial records, academic results. Most Nigerian schools are technically out of compliance and most have not been audited yet. That will not last.

The seven basic obligations

1. A privacy notice on the school website

Plain language, not legalese. What data you collect, why you collect it, who you share it with, how long you keep it, and how parents can request a copy or deletion. If your school does not have a privacy notice, that is the cheapest fix on this list and the easiest to do.

2. Lawful basis for every data point

You must be able to justify why you collect each piece of data. Student name and date of birth — operationally essential. Parent income brackets — only if needed for scholarship assessment, and consented. Religion — almost never lawfully needed, and a regulator will ask why you have it.

3. Consent that is meaningful

"By submitting this form you agree to all our terms" is not consent under NDPR. Consent must be specific, informed, and revocable. For minors, consent must come from the parent or guardian, not the child.

4. Reasonable security

This is the obligation that catches most schools. Storing student records as Excel files on the bursar's personal laptop with no password is not reasonable security. The minimum is: encrypted storage, access only by named staff, audit log of who accessed what, and a written policy.

5. Data Protection Officer (DPO) or equivalent

Schools above 50 staff or handling data of 1,000+ individuals need a designated Data Protection Officer — could be a staff member with the role added to their job description, does not have to be a full-time hire. The DPO is the named contact for any data subject request.

6. Breach notification

If student data is leaked, lost, or accessed by an unauthorised party, you must notify the regulator (Nigeria Data Protection Commission) within 72 hours of discovering the breach. Documented incident response procedure required.

7. Annual data audit

For schools above the threshold, an annual NDPR audit by a licensed Data Protection Compliance Organisation. Cost typically ₦300,000 to ₦800,000 depending on size. Smaller schools can do internal audits and document them.

The ten-minute self-check

Right now, ask: (1) Where are student exam results stored? (2) Who has access to that storage? (3) Is the storage encrypted or password-protected? (4) When was the last time access was reviewed? (5) If a parent requested deletion of their child's data tomorrow, would you know how to do it? Most schools cannot confidently answer all five. That is the gap.

How software helps

A purpose-built school management system handles most of these obligations natively — encrypted storage, role-based access, audit log, configurable retention, DSAR (data subject access request) export. The school still owns the obligation, but the technical heavy-lifting is built in. This is one of the reasons we build NDPR-aligned features into every deployment.

For an NDPR readiness assessment for your school, contact our compliance team on info@eboluw.com.