Most Nigerians know the routine. A store you visited once starts sending WhatsApp promotions. You reply STOP, and a week later another message lands, this time by SMS.
For the business, that is a CRM problem before it is a legal one. The opt-out lived in one inbox and never reached the system that sends campaigns.
NDPA compliance CRM work starts there. Your customer database should know why it holds each record, what each person agreed to, and where the data travels. This guide covers the rules for sales and marketing teams under the Nigeria Data Protection Act 2023 and the NDPC’s 2025 directive.
Key takeaways
- In an NDPA compliance CRM, every record needs a lawful basis. For direct marketing, that usually means consent you can prove.
- Under the NDPA, silence is not consent, and withdrawing consent must be as easy as giving it.
- Organisations handling data on more than 200 people in six months may be of “major importance.” They must register with the NDPC, at fees from ₦10,000 to ₦250,000.
- Larger registrants file an annual Compliance Audit Return through a licensed DPCO.
- Breaches likely to harm people must reach the NDPC within 72 hours. Transfers to US or EU cloud CRMs need a legal basis under sections 41 to 43.
Why does NDPA compliance CRM work matter now?
Because the regulator now collects fines. In 2024 the Nigeria Data Protection Commission fined Fidelity Bank ₦555.8 million, about 0.1% of its 2023 gross revenue, Techeconomy reported. The findings included processing personal data without informed consent and relying on non-compliant third-party processors.
MultiChoice Nigeria followed with a ₦766.2 million fine in July 2025. That case included unlawful cross-border transfers of subscriber data, according to BusinessDay. The same report says the NDPC had concluded 246 investigations and registered 38,677 organisations of major importance.
Both cases turn on everyday CRM questions. Who gave consent, which vendor touched the data, and where did it go?
What does the NDPA require of a customer database?
The Act sets principles that map directly onto CRM fields. The NDPA text requires data to be “retained for not longer than is necessary” for the lawful basis behind it (section 24).
Section 25 lists the lawful bases. They include consent, performance of a contract, legal obligation and legitimate interests. Section 26 then puts the burden of proving consent on the business, not the customer.
In practice, an NDPA compliance CRM setup can answer four questions about any contact:
- Where did this record come from?
- What lawful basis lets us use it?
- What exactly did the person agree to?
- When should we delete it?
Which lawful basis covers sales and marketing data?
It depends on the activity. Sending an invoice or a delivery update to a paying customer rests on the contract. Keeping tax records rests on legal obligation.
Legitimate interest is tempting for sales follow-up, but the NDPA narrows it. Section 25(2) rules it out where the processing overrides people’s rights or where they “would not reasonably expect” it. The NDPC’s General Application and Implementation Directive (GAID) 2025 requires a documented legitimate interest assessment, Mondaq’s summary notes.
Direct marketing is clearer. The same summary says Article 18 of the GAID makes consent mandatory for direct marketing, sensitive data, children’s data and automated processing.
How should a CRM handle consent for WhatsApp and SMS marketing?
Start with the Act’s wording. Section 26(3) says “silence or inactivity of the data subject shall not constitute consent.” A pre-ticked box or a number copied from a delivery form does not count.
Withdrawal must be easy. Section 35(2) requires that withdrawing consent be “as easy” as giving it. Under section 36, a person can object to direct marketing “at any time,” and the business must then stop.
Platform rules add a second layer. WhatsApp’s Business Messaging Policy requires opt-in permission before a business messages anyone. It also requires businesses to respect opt-out requests made “on or off WhatsApp.”
SMS has its own switch. The Nigerian Communications Commission’s Do-Not-Disturb service lets subscribers text STOP to 2442 to block unsolicited SMS and calls. Network operators apply that block, but your CRM should still record the person’s choice.
An NDPA compliance CRM setup therefore stores consent as data, not as a note. Useful fields include:
- Channel consented (WhatsApp, SMS, email, calls), each as a separate field.
- Date, time and source of consent, such as a web form, a till prompt or a WhatsApp keyword.
- The exact wording the person saw, with a version number.
- Opt-out date and channel, synced to every sending tool within minutes.
That last point is where most failures happen. If your WhatsApp platform, SMS gateway and email tool each keep their own lists, the opt-out never travels. Our piece on customer follow-up in Nigeria covers the follow-up side of the same plumbing.
Do you need to register with the NDPC?
Possibly, and the threshold is low. Check registration early in any NDPA compliance CRM review.
Section 44 of the NDPA requires data controllers and processors “of major importance” to register with the Commission. The NDPC’s registration guidance notice applies to organisations that process data on more than 200 people within six months.
The notice also captures commercial ICT service providers and whole sectors. Those include financial services, health, insurance, education, hospitality, e-commerce and telecoms. The notice sets three tiers:
| Tier | Typical trigger in the notice | Registration fee | Ongoing duty (GAID Art. 9) |
|---|---|---|---|
| Ordinary-High Level (OHL) | 200 to 1,000 data subjects in six months | ₦10,000 | Renew annually, no audit return |
| Extra-High Level (EHL) | 1,000 to 5,000 data subjects, plus listed types such as microfinance banks | ₦100,000 | Register once, file annual audit return |
| Ultra-High Level (UHL) | Over 5,000 data subjects, plus listed types such as commercial banks, telcos and fintechs | ₦250,000 | Register once, file annual audit return |
A busy Lagos retailer with a WhatsApp list of 6,000 customers could therefore fall into the top tier. Check the classification against the notice itself before you file.
What do DPCO audits and audit returns involve?
EHL and UHL registrants file an annual Compliance Audit Return, or CAR. A Templars client alert says the return must go through a licensed Data Protection Compliance Organisation (DPCO) on the NDPC portal. It set the 2025 return deadline at 31 March 2026.
The NDPC later extended that deadline to 30 May 2026, Olisa Agbakoba Legal reported. Templars lists CAR filing fees from ₦100,000 to ₦1,000,000, depending on tier and volume. Late filing can add up to 50% of the fee.
The audit looks at governance, security controls, accountability, cross-border transfers and third-party processors. Your CRM vendor sits in two of those five areas. Section 32 also requires organisations of major importance to appoint a Data Protection Officer.
What happens if your CRM data is breached?
The clock starts when you become aware.
Breach readiness is where NDPA compliance CRM planning meets vendor management. Section 40(2) requires notice to the NDPC “within 72 hours” of discovering a breach likely to put people’s rights at risk.
Where the risk is high, section 40(3) says you must tell affected customers “immediately” in plain language. Section 40(1) also obliges processors, including your CRM or messaging vendor, to tell you when they discover a breach.
So check your vendor contracts. They should name a notification window shorter than 72 hours, or you will hear too late to meet your own deadline.
Can you keep customer data in a US or EU cloud CRM?
Yes, but not by default. Section 41 allows transfers abroad only where the recipient is bound by a law, binding corporate rules or contract clauses giving adequate protection. Section 43 adds other routes, including informed consent and transfers needed to perform a contract with the customer.
Most cloud CRMs store data abroad. HubSpot, for example, hosts customer data on AWS in the United States, Germany, Canada and Australia. Paid accounts can change their data centre.
Law firm Banwo & Ighodalo summarises the GAID position plainly: transfers outside Nigeria “require adequate safeguards or prior approval.”
For NDPA compliance CRM purposes, the hosting region belongs in your records. Keep a transfer record for each vendor, sign its data processing terms, and note which section of the Act you rely on.
How long can you keep customer records?
The NDPA sets no fixed number of years for sales data. Section 24 ties retention to purpose instead, which makes it easy to neglect in NDPA compliance CRM work. Once a lead goes cold or a contract ends, the reason to keep the record weakens.
Set retention rules by record type. Unconverted leads might expire after a defined period of silence, while invoices follow tax rules. Most CRMs can flag or delete records automatically once a date passes.
What are the penalties for getting it wrong?
Section 48 sets two ceilings. Organisations of major importance face up to ₦10 million or 2% of the previous year’s annual gross revenue, whichever is greater. Others face up to ₦2 million or 2%.
The Fidelity and MultiChoice cases show the NDPC will use those powers. The bigger cost is often the remediation work after a finding.
An NDPA compliance CRM checklist
Use this table to review your current setup. It maps each legal duty to the CRM feature that supports it.
| Duty | NDPA or GAID reference | CRM feature |
|---|---|---|
| Prove consent | s.26(1) | Consent fields with source, date and wording version |
| Easy withdrawal | s.35(2), s.36 | One-click unsubscribe synced to all channels |
| Purpose-based retention | s.24 | Retention dates and automatic deletion |
| Breach response | s.40 | Audit logs, access alerts, vendor notice clauses |
| Lawful transfers | ss.41 to 43 | Known hosting region and signed processing terms |
| Annual audit | GAID Art. 7 and 9 | Exportable records of processing and processors |
At Riophany, we build consent fields, opt-out syncing and retention rules into Zoho, HubSpot and Salesforce projects from the first workshop. Our CRM services treat an NDPA compliance CRM design as part of the build, not a later patch. This guide is general information, not legal advice, so confirm your position with a DPCO or lawyer.
The customer who typed STOP was not asking for a compliance programme. She was asking to be remembered. A well-built CRM is simply the part of the business that does.
Frequently asked questions
Does the NDPA apply to small businesses?
Yes. The Act’s principles apply to anyone processing personal data in Nigeria. Registration duties apply to organisations of major importance, which the NDPC’s notice links to processing data on more than 200 people in six months, among other triggers.
Can I add customers to a WhatsApp marketing list without asking?
No. The NDPA says silence is not consent, the GAID makes consent mandatory for direct marketing, and WhatsApp’s own policy requires opt-in before you message anyone.
How much does NDPC registration cost?
The NDPC’s notice sets ₦10,000 for Ordinary-High Level, ₦100,000 for Extra-High Level and ₦250,000 for Ultra-High Level registrants. Annual audit return fees are separate.
How quickly must a CRM breach be reported?
Within 72 hours of becoming aware, if the breach is likely to put people’s rights at risk. High-risk breaches must also reach affected customers immediately.
What should an NDPA compliance CRM review check first?
Start with consent records and opt-out syncing across WhatsApp, SMS and email. Then confirm your NDPC registration tier and where each vendor hosts your data.
Is it legal to use a CRM hosted in the US or Europe?
Yes, if you rely on a basis in sections 41 to 43 of the NDPA, such as adequate contractual protection or informed consent. Document the basis for each vendor.
