This module explains the distinction between personal data and sensitive personal data. It defines personal data as any information that can directly or indirectly identify an individual—such as name, phone number, email address, or identification number. It further explains sensitive personal data as a special category of personal information that includes health records, biometric data, religious or political beliefs, sexual orientation, and financial information. These require stricter handling and higher levels of protection due to their potential impact on an individual’s rights and freedoms.

Personal & Sensitive Personal Data 

Personal Data & Sensitive Personal Data 

This module explains the core principles that guide the processing of personal data and the lawful bases that justify such processing under data protection laws.

Participants will learn that data must be processed lawfully, fairly, and transparently; collected for specific and legitimate purposes; limited to what is necessary; kept accurate and up to date; stored securely; and retained only for as long as necessary.

The module also explores the lawful bases for data processing, which include:

Consent of the data subject

Performance of a contract

Legal obligation

Vital interests

Public interest or official authority

Legitimate interests pursued by the data controller or a third party

Understanding these principles and bases helps ensure compliance with regulations like the Nigeria Data Protection Act (NDPA) and international standards.

Principles and Lawful Basis of Data Processing 

This module explains the rights granted to individuals (data subjects) under data protection laws. It empowers participants with knowledge of how individuals can control and protect their personal data.

Key rights covered in this module include:

Right to be informed – to know how their data is being collected and used

Right of access – to request and obtain a copy of their personal data

Right to rectification – to correct inaccurate or incomplete data

Right to erasure (right to be forgotten) – to request deletion of their data in certain situations

Right to restrict processing – to limit how their data is used

Right to data portability – to receive and transfer their data in a usable format

Right to object – to stop certain types of processing, such as direct marketing

Rights related to automated decision-making and profiling

Data Subject's Rights 

Data Subject’s Rights

This module explains the distinct roles and legal obligations of Data Controllers and Data Processors in the handling of personal data.

A Data Controller determines the purpose and means of processing personal data, while a Data Processor processes data on behalf of the controller.

Data Controllers & Data Processors Obligations 

This module explains the importance of securing personal data throughout its lifecycle—collection, storage, use, transfer, and disposal.

Participants will explore the technical and organizational measures required to prevent unauthorized access, data breaches, loss, or corruption.

Data Security 

This module explains what constitutes a data breach, how it can occur, and the steps organizations must take to prevent, detect, and respond effectively.

A data breach refers to any unauthorized access, disclosure, loss, alteration, or destruction of personal data—whether accidental or deliberate.

Data Breach 

This module explains the purpose, structure, and legal importance of a Privacy Policy in data protection compliance.

A privacy policy is a public-facing document that outlines how an organization collects, uses, stores, shares, and protects personal data. It builds trust with users and helps organizations meet transparency obligations.

Privacy Policy

This module explains the concept, purpose, and process of conducting a Data Privacy Impact Assessment (DPIA)—a mandatory tool for identifying and minimizing data protection risks in projects that involve personal data.

Data Privacy Impact Assessment 

This module explains the critical role and responsibilities of the Data Protection Officer (DPO) in ensuring an organization’s compliance with data protection laws.

The Role of the Data Protection Officer (DPO)

The Role of Data Protection Officer (DPO)

This module introduces the foundational concepts of data privacy and data protection, highlighting their importance in today’s digital and data-driven world.

Data Privacy & Data Protection 

This module provides an in-depth exploration of the NDPC—its establishment, mandate, structure, and key responsibilities—in implementing Nigeria’s data protection regulatory framework.

The Nigeria Data Protection Commission 

This module provides additional reading materials that form the legal foundation for data protection and privacy in Nigeria. It includes the full text of the Nigeria Data Protection Act (NDPA) 2023 and the General Application and Implementation Directive (GAID).

Nigeria Data Protection Act (NDPA) 2023

General Application and Implementation Directive (GAID) 2025

Legal Framework for Data Protection in Nigeria: NDPA 2023 & GAID

This video tutorial series is designed to equip professionals, aspiring Data Protection Officers, and organizational stakeholders with the practical knowledge and skills needed to understand and implement data protection principles effectively.

Cybersecurity Dangers in Plain Sight: Public Wi-Fi, USB Cables & Weak Passwords

Think Before You Share: The Hidden Dangers of Posting Your Child's Videos Online

Privacy & Confidentiality 

 Video Tutorial Series: Mastering Data Protection

The General Employee Privacy Awareness Training is designed to educate and empower employees on the importance of data privacy and the role they play in safeguarding personal information. This course provides a comprehensive understanding of data protection principles, the organization's data privacy policies, and best practices for data security. It aims to equip employees with the knowledge and skills necessary to handle personal data responsibly, ensure compliance with data protection regulations, and maintain the organization's reputation.

Participants who successfully complete the course and pass the assessment will receive a Certificate of Completion, demonstrating their understanding of data privacy and their commitment to protecting personal data.

General Employee Privacy Awareness Training (GEPAT)

Data Protection & Privacy Academy

Course Details

Course content