F.A.Q
As organizations increase the amount of data they store, the risk of cyber attacks also increases. Data protection helps mitigate the risk of a company’s sensitive and personal information being stolen from fraudulent activities such as hacking, phishing and identity theft.
Unfortunately, data breaches can cause devastating damage to an organization, resulting in hefty fines, reputational damage, a decrease in sales, a loss of trust and legal penalties from governing bodies.
With the ever-increasing volume of cyber related crime and potential penalties associated with data protection legislation, we have carefully reviewed the questions asked by organizations in respect of data protection audit and compliance under NDPR.
You Must Know
Data protection is a strategy that focuses on protecting a company’s data from data breaches and fraudulent activities, such as hacking, phishing, identity theft and other threats from external forces.
There are two reasons why this is important. Firstly, because protecting this data is crucial to the seamless operations of your business, and, secondly, because when handling personal data your organization must comply with the data privacy regulations that apply to your business.
Personal data is typically ‘Personal Identifiable Information’ (PII) of a natural living person (i.e. not a deceased person).
PII includes directly identifiable data, such as names, addresses, telephone numbers, bank details, as well as information that can be linked together to identify an individual, such as an employee record number.
Data processing refers to any operation which is performed on personally identifiable information.
Typically, this is any step that your organization takes to collect and manipulate that data into meaningful information.
Data processing is likely to involve various stages, such as collection, validation, sorting, storage, classification and reporting.
A Data protection compliance audit is a systematic and independent assessment of an organization’s compliance with the NDPR.
Yes.
Any person subject to this Regulation who is found to be in breach of the data privacy rights of any Data Subject shall be liable, in addition to any other criminal liability, to the following:
In the case of a Data Controller dealing with more than 10,000 Data Subjects, payment of the fine of 2% of Annual Gross Revenue of the preceding year or payment of the sum of 10 million Naira, whichever is greater;
In the case of a Data Controller dealing with less than 10,000 Data Subjects, payment of the fine of 1% of the Annual Gross Revenue of the preceding year or payment of the sum of 2 million Naira, whichever is greater.
Therefore, you should be ensuring that you are compliant with the legislation and you are also doing everything possible to mitigate the risk of a data breach.
Yes. Organisations are expected to file their data audit report annually before the 15th of March of a new year.
This is a very common question but not a difficult answer.
There is not a set checklist of things that an organization’s has to do in order to demonstrate compliance.
Of course, all of the articles within the legislation have to be complied with but that will differ from organisation to organisation in the method of compliance.
Privacy Audit Returns is to be filed with the Bureau through a Licensed DPCO
Obviously, Data Oracle can support you on your journey.
We offer a very applicable training course that is ideal if you are looking to train as a Data Protection Officer (DPO).
DPO training is focused on what a DPO needs to do in relation to managing and maintain data protection compliance in a typical organisation.
However, please note, DPO’s cannot have a conflict of interest with another role that individual may have within that organisation.
One of the obligations of any organisation that processes personal data of up to 1000 data subjects in a six- month period, and 2000 data subjects in a twelve-month period, is the filing of a data audit report with the Nigeria Data Protection Commission.