This foundational module provides participants with a clear understanding of the concepts, principles, and legal framework governing data protection and privacy. It begins by defining privacy and data protection and explaining their importance in today’s digital and regulatory environment.

The module introduces participants to personal data and its classifications, exploring how such data is processed and the specific considerations required when handling sensitive personal data and the personal data of children. It also identifies the key stakeholders involved in data protection, including data subjects, data controllers, data processors, and supervisory authorities.

Special focus is given to the Nigeria Data Protection Act (NDPA) 2023, its objectives, and the role of the Nigeria Data Protection Commission (NDPC) in ensuring compliance, enforcement, and the promotion of responsible data processing practices.


Nigeria Data Protection Act 2023 

General Application & Implementation Directive (GAID) 2025

Data Privacy Keywords 

Introduction to Data Protection and Privacy

Module 1: Personal Data

 Introduction to Data Protection and Privacy

This module explores the core principles that govern the processing of personal data, ensuring participants understand the ethical and legal standards required for compliance with data protection laws. It introduces the principles of personal data processing—lawfulness, fairness, transparency, purpose limitation, data minimization, storage limitation, accuracy, security, confidentiality, duty of care, and accountability—and explains their significance in safeguarding data subjects’ rights.

The module provides an in-depth look at the Lawfulness, Fairness, and Transparency principle, breaking it down into its components to highlight how organizations must act responsibly when collecting, using, and sharing personal data. It further emphasizes the importance of each principle, such as ensuring accurate data, limiting storage duration, minimizing unnecessary collection, and applying strong security controls.

Principles and Lawful Bases for Data Processing

Module 2: Principles and Lawful Basis

This module provides participants with a comprehensive understanding of the rights afforded to individuals (data subjects) under data protection law, with emphasis on the Nigeria Data Protection Act (NDPA) 2023. It begins by explaining how to identify a data subject and then explores each of their statutory rights.

Participants will learn about the Right to be Informed, Right of Access, Right to Rectification, Right to Erasure (Right to Be Forgotten), Right to Data Portability, Right to Restriction of Processing, and the Right to Object to processing. The module also covers the Right to Withdraw Consent, the Right not to be subject to automated decision-making or profiling, and the Right to lodge complaints with the Nigeria Data Protection Commission (NDPC).

Rights of Data Subjects

Module 3: Data Subject’s Rights

This module introduces participants to the distinct roles of data controllers and data processors, highlighting their responsibilities within the data protection ecosystem. It begins by defining who qualifies as a controller or processor and explaining how their functions differ in the handling of personal data.

The module examines the responsibilities of both controllers and processors, including ensuring lawful processing, maintaining transparency, safeguarding data, and upholding the rights of data subjects. Participants will gain a clear understanding of the specific obligations imposed under the Nigeria Data Protection Act (NDPA) 2023, such as record-keeping, security measures, data protection impact assessments (DPIAs), and mandatory breach reporting.

Obligations of Data Controllers/ Processors

Module 4: Data Controllers and Processors

This module equips participants with the knowledge and skills to safeguard personal data through effective security practices, incident management, and compliance with the Nigeria Data Protection Act (NDPA) 2023. It introduces the concept of data security and explains the types of security incidents, how to identify them, and the appropriate response strategies. The module distinguishes between data security incidents and data breaches, emphasizing their impact on organizations and individuals.

Participants will explore the legal obligations around data breaches under the NDPA, including reporting requirements and consequences of non-compliance. The module also covers technical and organizational measures such as encryption, de-identification (pseudonymization and anonymization), backups, and risk assessments, which are essential for ensuring confidentiality, integrity, and availability of data.

Data Security

Data Breach

Technical Measures for Data Protection

Organization Measures for Data Protection

Privacy by Design (PbD)

Privacy by Default (PbDf)

Data Backup

De-identification of Personal Data

Data Privacy Impact Assessment (DPIA) 

Understanding Cookies: Key Concepts & Management

Privacy Policy 

Module 5: Data Security

This module addresses the growing challenges organizations face when sharing or outsourcing data processing activities to third parties such as vendors, partners, and collaborators. It begins with an introduction to third-party risks and explains how these risks can impact compliance, security, and organizational reputation.

Participants will learn how to categorize third-party data-related risks and apply risk assessment techniques to evaluate the level of exposure associated with different vendors. The module also highlights the benefits of proactively managing third-party risks, including stronger compliance, reduced data breach likelihood, and enhanced trust with stakeholders.

Managing Third-Party Risk: Vendors, Partners and Collaborations

Module 6: Managing Third-Party Risk: Vendors, Partners and Collaborations

This module explores the legal, regulatory, and operational considerations involved in transferring personal data across national boundaries. It begins with an introduction to the concept of cross-border data transfers, explaining why organizations often need to share data internationally and the associated risks.

Participants will learn about the adequacy decision framework, where certain countries are recognized as providing sufficient levels of data protection, making transfers to them lawful. The module also reviews various cross-border transfer instruments, such as contractual clauses, binding corporate rules, and standard data protection clauses, as well as other lawful bases permitted under the Nigeria Data Protection Act (NDPA) 2023.

Cross-Border Data Transfers

Module 7: Cross-Border Data Transfers

This module examines how rapidly evolving emerging technologies such as artificial intelligence (AI), machine learning, blockchain, Internet of Things (IoT), cloud computing, and big data analytics impact data protection and privacy. It provides an overview of these technologies, highlighting both their opportunities and the risks they pose to personal data security, transparency, and accountability.

Participants will explore the data protection challenges associated with emerging technologies—such as bias in AI, surveillance risks, cross-border data flow complexities in cloud services, and the permanence of records on blockchain. The module also considers how the Nigeria Data Protection Act (NDPA) 2023 applies to these technologies, ensuring that innovation does not come at the expense of compliance and individual rights.

Emerging Technologies and Data Protection

Module 8: Emerging Technologies and Data Protection

This module provides a detailed understanding of the Data Protection Officer (DPO) role, its functions, and its strategic importance in ensuring compliance with the Nigeria Data Protection Act (NDPA) 2023. It begins by defining who a DPO is and outlining their central role in embedding data protection principles across an organization.

Participants will examine how the DPO ensures adherence to the core principles of data protection—including transparency, purpose limitation, storage limitation, data minimization, accuracy, integrity, confidentiality, and accountability. The module also explains the specific actions DPOs must take to ensure that data controllers and processors meet their statutory obligations under the NDPA, such as monitoring compliance, facilitating staff training, advising on Data Protection Impact Assessments (DPIAs), and serving as the point of contact with the Nigeria Data Protection Commission (NDPC).

Roles and Responsibilities of a Data Protection Officer

Module 9: Roles and Responsibilities of a Data Protection Officer

This module delve into the critical aspects of social engineering and phishing through engaging explainer videos. 

Introduction 

Episode One 

Episode Two

Episode Three

Episode Four 

Episode Five

Episode Six 

Episode Seven 

Episode Eight 

Episode Nine

Episode Ten 

Episode Eleven 

Episode Twelve

Social Engineering and Phishing Explainer Videos  

This module is designed to educate individuals on the various types of cyber threats, their potential impacts, and the best practices to mitigate these risks. 

Episode One

Episode Five 

Episode Six

Episode Nine 

Cyber Security Risks Awareness Videos 

Module 1: Introduction to Data Protection and Privacy1.1 Introduction: Definition of Privacy and Data Protection1.2 Importance of Data Protection1.3 Personal Data1.4 Processing of Personal Data1.5 Factors for Processing Sensitive Personal Data1.6 Processing of Personal Data of Children1.7 Key Stakeholders1.8 Nigeria Data Protection Act (NDP Act) 20231.9 Objectives of the NDP Act1.10 Role of the Nigeria Data Protection Commission (NDPC)Module 2: Principles and Lawful Bases for Data Processing2.1 Principles of Personal Data Processing2.2 Key Principles of Data Protection2.3 Lawfulness, Fairness and Transparency2.3.1 The Lawfulness, Fairness and Transparency Principle - Lawfulness 2.3.2 The Lawfulness, Fairness and Transparency Principle – Fairness2.3.3 The Lawfulness, Fairness and Transparency Principle – Transparency2.4 Importance of Lawfulness, Fairness, and Transparency Principles2.5 The Purpose Limitation Principle2.5.1 The Importance of Purpose Limitation Principle2.6 Data Minimization2.6.1 Importance of Data Minimization Principles2.7 Storage Limitation2.7.1 Importance of Storage Limitation Principle2.8 Accuracy2.8.1 Importance of Accuracy2.9 Appropriate Security and Protection (Integrity and Confidentiality Principle)2.9.1 Importance of Appropriate Security and Protection (Integrity andConfidentiality Principle)2.10 Duty of Care and Accountability2.10.1 Importance of Duty of Care and Accountability2.11 Lawful Basis for Personal Data Processing2.12 Lawful Basis for Processing Data According to NDP Act 20232.13 Determining the Appropriate Lawful Basis for Data Processing ActivitiesModule 3: Rights of Data Subjects3.1 Identification of a Data Subject3.2 Data Subject’s Rights3.2.1 Right to be Informed3.2.2 Right of Access3.2.3 Right to Rectification3.2.4 Right to Erasure (The Right to Be Forgotten)3.2.5 Right to Portability3.2.6 Right to Restriction of Processing3.2.7 Data Subject has the right to object to the processing of his or her Personal Data3.2.8 Right to Withdraw Consent3.2.9 Right not to be subject to decision based solely on automated decision- making and profiling3.2.10 Right to complain to the relevant Data Protection Authority (NDPC):3.3 Steps to Operationalise Data Subject Rights RequestsModule 4: Obligations of Data Controllers/ Processors4.1 Who is a Data Controller?4.2 Who is a Data Processor?4.3 Responsibilities of Data Controllers &amp; Data Processors4.4 Obligations of Data Controllers and Processors under the NDP Act4.5 Consequences of Non-Compliance with the NDP ActModule 5: Data Security5.1 Data Security5.2 What are Security Incidents?5.2.1 Examples of Data Security Incidents5.3 Identifying Data Security Incidents5.3.1 Responding to Data Security Incidents5.4 Data Breach5.5 Data Breach under the NDP Act5.6 Impact of Data Breaches5.7 Difference Between Data Breach and Data Security Incident5.8 Technical and Organizational Measures5.9 De-identification of Personal Data5.9.1 Pseudonymization5.9.2 Anonymization5.10 Data Encryption5.10.1 Types of Encryptions5.11 Stages of Data Processing5.12 Data Backup5.13 What is a Privacy Policy?5.13.1 Components of a Privacy Policy5.13.2 Sample of Privacy Policy5.14 Cookies and their Significance in Privacy5.14.1 Types of Cookies5.15 What is a Cookie Policy?5.16 Understanding Cookie Management5.17 Data Privacy Impact Assessment (DPIA)5.17.1 When to conduct a Data Privacy Impact Assessment (DPIA) 5.17.2 Data Privacy Impact Assessment (DPIA)5.17.3 How to Conduct a DPIA?5.18 Risk Assessment Techniques5.19 Privacy by Design5.19.1 Example of Privacy by Design5.20 Privacy by Default5.21. Example of Privacy by DefaultModule 6: Managing Third-Party Risk: Vendors, Partners and Collaborations6.1 Introduction to Third-Party Risks6.2 Categorizing Third-Party Data Related Risks6.3 Risk Assessment Techniques6.4 Benefits of Proactively Managing Third-Party Risks6.5 The Third-Party Vendor Due Diligence Lifecycle6.6 Vendor Due Diligence by the Data Controller/ Data ProcessorModule 7: Cross-Border Data Transfers7.1 The Concept of Cross-Border Data Transfer7.2 Adequacy Decision7.3 Cross-Border Data Transfer Instruments7.4 Other Bases for the Cross-Border Transfer7.5 Challenges in Cross-Border Data Transfer7.6 Safeguarding Data in Cross-Border Data TransferModule 8: Emerging Technologies and Data Protection8.1 Understanding Emerging Technologies8.2 Some Emerging Technologies and Data Protection Challenges8.3 Emerging Technologies and NDP Act8.4 Considerations for Emerging TechnologiesModule 9: Roles and Responsibilities of a Data Protection Officer9.1 Who is a Data Protection Officer?9.2 Role of Data Protection Officers in relation to Principles of Data Protection9.3 Role of the Data Protection Officer in Ensuring Transparency9.4 The Role of the DPO in ensuring Purpose Limitation9.5 Role of the Data Protection Officer in Ensuring Storage Limitation9.6 Role of the Data Protection Officer in Ensuring Data Minimization9.7 The Role of the DPO in Ensuring Accuracy9.8 The Role of the DPO in Ensuring Integrity and Confidentiality9.9 Role of the Data Protection Officer in Ensuring Accountability9.10 Actions to be taken by the DPO to Ensure Data Controllers/ Data Processors meet their Obligations under the NDP Act9.11 Role of DPOs in Emerging TechnologiesAppendix I: Convention 108+Appendix II: Comparing the EU General Data Protection Regulation (GDPR) and the Nigeria Data Protection Act (NDP Act)Appendix III: The African Union Convention on Cybersecurity and Personal Data Protection (AUCC) / Malabo Convention Context.Appendix IV: Ecowas Supplementary ActAppendix V: Data LocalizationAppendix V: Data Protection Action PlanAppendix VI: ROPA sample

The Data Protection Officer Certification Course is designed to equip participants with the essential knowledge, skills, and understanding necessary to excel in the role of a Data Protection Officer. 

Data Protection Officer Certification Course 

Data Protection Academy 

Primary Menu

Data Protection Officer Certification Course

Data Protection & Privacy Academy

Course Details

Course content

Includes