The introduction of the Nigeria Data Protection Act, 2023 (“NDPA”) and its implementing framework, the General Application and Implementation Directive, 2025 (“GAID 2025”), has fundamentally transformed how personal data is handled in the Nigerian workplace. These regulations impose specific obligations on employers and establish enforceable rights for employees in relation to the collection, use, and management of their personal data. They include strict rules on surveillance, record-keeping, and employee rights, transforming how employers must handle everything from CCTV footage to performance tracking systems.

This article focuses on key compliance standards for Nigerian employers and outlines the rights of employees under the current legal regime.

Legal framework: NDPA 2023 and GAID 2025

The NDPA 2023 provides the legal framework for personal data protection in Nigeria, establishing guiding principles such as lawfulness, fairness, transparency, and purpose when dealing with personal data.¹ The GAID 2025, issued by the Nigeria Data Protection Commission (“NDPC”), operationalises these principles and introduces sector-specific obligations, including those applicable to employment relationships.²

From a compliance standpoint, employers are considered “data controllers”³ when they collect and process employee information. They are thus obligated to comply with all requirements of the NDPA and the GAID 2025 when handling employee data. Employees, on the other hand, whose personal data is collected and processed, are referred to as “data subjects”⁴ under the NDPA and GAID.

Monitoring employees: balancing oversight and rights

Surveillance of employees in the workplace, whether through CCTV, email monitoring, or internet activity logs is not prohibited under any Nigerian law. However, it must comply with the provisions of the NDPA and the GAID 2025, particularly in relation to lawfulness, necessity, purpose and proportionality.⁵

Key compliance requirements for employers

1. Monitoring Must Be Lawful, Necessary, and Proportionate

The GAID 2025 reiterates that surveillance in the workplace must meet the three-part test of lawfulness, necessity, and proportionality. Employers must be able to demonstrate that:

1. The monitoring serves a legitimate purpose (e.g. workplace security, fraud prevention)

2. There are no less intrusive alternatives to achieve the same goal

3. The extent of monitoring is proportionate to the risk being addressed

Employers must avoid continuous surveillance that encroach on employee dignity. Over-monitoring or covert surveillance, for instance, (especially without a legal basis) unless narrowly justified may amount to a violation of the NDPA and may also infringe on the constitutional right to privacy under Section 37 of the 1999 Constitution. Monitoring outside of work hours or accessing private communications without compelling justification may also amount to a breach of the NDPA and infringe the right to dignity under section 34 of the 1999 Constitution.

2. Privacy notices and employee awareness

Employers are required to clearly inform employees of any monitoring practices. This must be done through a clear and accessible well-drafted privacy notice that outlines the nature, purpose, legal basis, scope of monitoring, data retention periods and employee rights and grievance procedures.⁶ As such, merely placing CCTV cameras in the workplace is not sufficient.

3. Consent is not a catch-all solution

The NDPA discourages reliance on employee consent as the sole basis for data processing, particularly in circumstances where there is a clear power imbalance.⁷ In most cases, consent will not be considered freely given and may therefore be invalid. Under the GAID 2025 and section 25 of the NDPA, employers may rely on legitimate interests as a lawful basis for surveillance. Common examples include ensuring workplace security, preventing data breaches, or protecting company assets. However, these interests must be weighed against the employee's fundamental rights and must not be excessive or intrusive.

Employers may also rely on other lawful bases, such as contract performance, legal obligation, and ensure these are clearly documented and explained to employees.⁸

4. Data protection impact assessment (“DPIA”)

Under the GAID 2025, any form of data processing that presents a ‘high-risk’ (such as biometric scanning, GPS tracking, or large-scale monitoring) to the rights of data subjects may require a formal DPIA.⁹ Employers are required to evaluate the risks to employees’ privacy and document mitigating measures. This requirement applies particularly where biometric systems, automated decision-making tools, or large-scale surveillance technologies are in use.

5. Data retention and minimisation

The data protections laws of Nigeria require employers to adhere to the principle of data minimization, collecting only the data that is necessary for a specific and lawful purpose.¹⁰ Employers must implement clear data retention policies, specifying how long different categories of employee data will be stored and the basis for such retention. Surveillance data, for example, should not be retained indefinitely unless justified by business necessity.

Employee data rights in the workplace

Employees are granted several data subject rights under the NDPA and the GAID 2025. These rights apply equally in the context of workplace surveillance and general HR data processing.

A. Right to access

Employees can make a request for the personal data an employer holds on them, including monitoring records and internal notes, subject to certain legal exemptions.¹¹

B. Right to rectification and erasure

If data held by the employer is inaccurate or outdated, the employee can request that it be corrected or deleted, unless retention is required by law or necessary for a legitimate business interest.¹²

C. Right to notification of data breaches

Where a data breach affects employee personal data, for instance, if surveillance footage is leaked, employers must notify the affected individuals and the NDPC within 72 hours, in line with the GAID 2025 section 13 and section 40 of the NDPA.

D. Right to lodge a complaint and standard notice to address grievance (“SNAG”)

The GAID 2025 introduces the SNAG mechanism. This allows employees to formally raise privacy concerns with their employer . If unresolved, the matter can be escalated to the Nigeria Data Protection Commission for investigation and enforcement.¹⁴

Penalties for non-compliance

Non-compliance with data privacy obligations can lead to substantial legal and financial consequences for employers. Under the NDPA, penalties may include:

• Regulatory fines of up to ₦10 million or 2% of gross annual revenue (usually whichever is larger);
• Enforcement orders, including mandatory data deletion;
• Reputational damage and potential civil liability from affected employees; 

Conclusion

The implementation of the NDPA 2023 and GAID 2025 marks a new era of accountability in the Nigerian workplace. Employers must be deliberate in how they collect, process, and store employee data, particularly in relation to surveillance and performance monitoring.

By adopting transparent policies, limiting the scope of monitoring, and respecting employee rights, organisations can build a compliant workplace culture that aligns with Nigeria’s evolving data protection landscape.

Compliance is no longer merely a legal requirement, it is also a trust-building tool that reinforces fairness, transparency, and mutual respect in the employment relationship.

1. Section 24 of the NDPA 2023
2. Section 1.2, Part I (Scope and Applicability) of the GAID 2025
3. Section 65 of the NDPA 2023, Interpretation of “Data Controller”
4. Section 65 of the NDPA 2023, Interpretation of “Data Subject”
5. Section 6.1(b)–(d) Part VI of the GAID 2025
6. Section 26(1) of the NDPA 2023 and section 3.4 of the GAID 2025;
7. Section 3.3.1 of the GAID 2025 and section 26(3)(b) of the NDPA 2023;
8. Section 25 of the NDPA 2023;
9. Section 6.2 of the GAID 2025 (High-Risk Processing and DPIAs);
10. Section 24(1)(c) of the NDPA 2023;
11. Section 34(1) of the NDPA 2023;
12. Sections 35 and 36 of the NDPA 2023;
13. Section 15.1 of the GAID 2025 (SNAG Mechanism)
14. Section 41 of the NDPA 2023.