Here’s a question that surprises a lot of business owners: how much personal data did your website collect last month?
Every contact form, booking widget, newsletter sign-up and WhatsApp button gathers names, numbers and sometimes much more. In Nigeria, that brings your website under the Nigeria Data Protection Act 2023, which is enforced by the Nigeria Data Protection Commission (NDPC).
Most owners we talk to know data protection matters. Very few know what it means for their actual website. So here’s a practical checklist to get you started. One quick note before we begin: this is general guidance for website owners, so for decisions about your specific obligations, check the NDPC’s guidance or talk to a qualified adviser.
Why start with your website?
Your website is where most personal data walks into your business. It’s also public. A missing privacy notice or a leaky form is visible to customers, competitors and regulators alike. Fix the front door first and everything else gets easier.
The checklist
1. Know what you collect, and why
Make a list of every form and tool that captures data: contact forms, bookings, chat, newsletter, analytics and payments. Next to each, write what you collect and why you need it. Can’t think of a reason for a field? Delete it.
2. Ask for less
Collecting only what you need is one of the core principles. A booking form can usually get by with a name, a phone number and a preferred time. Gather anything more sensitive later, through a secure channel.
3. Write a privacy notice a human can read
Explain in plain language what you collect, why, how long you keep it, who you share it with (your host, email provider, WhatsApp, payment provider) and how people can reach you about their data. Then link it from every form.
4. Get consent right for marketing
If you’d like to send newsletters or offers, use a clear, unticked opt-in box. Folding “I agree to marketing” into the “send enquiry” button is one of the most common mistakes we see.
5. Handle health information with extra care
Clinics, labs and wellness businesses should keep detailed medical information off ordinary website forms. Use secure, purpose-built systems with proper access controls, like the health applications we build for care providers.
6. Lock down the basics
- HTTPS on every page.
- WordPress, themes and plugins kept up to date.
- Strong passwords and two-factor login for every admin.
- Regular backups that you’ve actually tested.
- Form submissions cleared out of shared inboxes on a schedule.
7. Be ready when someone asks about their data
People can ask what you hold about them, ask you to correct it, or ask you to delete it. Decide who handles these requests and how, so nobody panics when the first one arrives.
8. Plan for a breach before it happens
The Act includes duties to tell the Commission about certain personal data breaches, with a 72-hour timeframe. Agree now who decides, who reports and where your records live, so you’re calm if the day ever comes.
A good privacy notice is a promise. A secure website is you keeping it every time someone presses “send”.
A sensible order of work
- This week: list your forms and remove fields you don’t need.
- This month: publish or refresh your privacy notice and fix your consent boxes.
- This quarter: tighten security, backups and admin access, and write down how you’ll handle requests and breaches.
Security updates, backups and monitoring are all part of our website management service. If you’d like us to look over your forms and privacy notice, just get in touch.
Frequently asked questions
Does the Nigeria Data Protection Act apply to small businesses?
The Act covers organisations that process personal data of people in Nigeria, and the Nigeria Data Protection Commission (NDPC) publishes guidance on how obligations scale with size and risk. Check the NDPC’s latest guidance or speak with a qualified adviser about your situation.
What counts as personal data on a website?
Anything that can identify a person: names, phone numbers, email addresses, WhatsApp numbers, sometimes IP addresses, and especially sensitive details like health information sent through booking or enquiry forms.
Is this article legal advice?
It’s a practical starting point for website owners. For decisions about your own obligations, check the NDPC’s guidance or speak with a qualified data protection professional.
Share this with whoever looks after your website forms. Trust takes years to build and one leaky form to dent.
Tagon Digital
Editorial team, Tagon Notes
Tagon Digital brings together website design, content strategy and digital marketing to help businesses improve online visibility and customer journeys.
Prepared by the Tagon Digital team with AI-assisted research and drafting. Facts and figures link to their original sources below. This article is general information for website owners and is not legal advice.
About the author
