Most Nigerian hospitals first encountered formal data protection through the NDPR (Nigeria Data Protection Regulation 2019), issued by NITDA. Compliance language in contracts and signage referenced it. Some hospitals invested in audit logs and role-based access. Most did not.

In June 2023, the National Assembly passed the Nigeria Data Protection Act 2023, signed into law shortly after. NDPA replaced NDPR as the highest-level data-protection instrument in Nigeria. NDPR did not disappear (its operational requirements largely carry forward), but the legal authority shifted, the enforcement mechanism changed, and a few specific operational obligations were tightened. Three years into NDPA, hospital boards are starting to be asked specific questions during audits, accreditation reviews, and HMO contract renewals.

This is the practical walkthrough of what changed, what stayed the same, and what your hospital management system has to support.

What changed at the legal level

Four structural changes between NDPR 2019 and NDPA 2023.

New regulator: NDPC replaces NITDA's data-protection mandate

Under NDPR, data protection was supervised by NITDA (the National Information Technology Development Agency) through its Data Protection Compliance Organisation framework. NDPA 2023 created the Nigeria Data Protection Commission (NDPC) as an independent statutory regulator. NDPC took on enforcement, registration of data controllers, investigation of complaints, and the issuance of guidance.

For hospitals, the practical change is who you register with, who you notify of breaches, and who an aggrieved patient complains to. NDPC publishes its own guidance and forms; the older NITDA NDPR Implementation Framework is no longer the canonical reference.

Tighter breach notification: 72 hours

NDPR required breach notification "within a reasonable time", with no specific deadline. NDPA 2023 introduced a 72-hour notification window from the time the controller becomes aware of a breach affecting individual rights. This is closely modelled on the EU GDPR's Article 33 timing.

For hospitals, the 72-hour clock starts when a clinician, administrator, or IT staff member learns of a likely breach (loss of an unencrypted device with patient data, a ransomware encryption event, an unauthorised access to records). The hospital has to investigate, document, and submit notification to NDPC within 72 hours, even if the investigation is incomplete. Late notification triggers separate sanctions.

Formal Data Protection Officer requirement

NDPR encouraged the appointment of a Data Protection Officer (DPO) but did not require it absolutely. NDPA 2023 makes DPO appointment mandatory for "Data Controllers of Major Importance", a category that includes most hospitals processing significant volumes of patient data. The DPO has to be qualified, independent from line management of the data-processing activities, and accessible to data subjects.

For mid-sized and larger Nigerian hospitals, this is a real operational change. A formal DPO has to be appointed, named in the registration with NDPC, and granted the budget and authority to investigate complaints and breaches independently of the medical director or administrator.

Registration as Data Controller of Major Importance

NDPA 2023 introduces explicit registration with NDPC for "Data Controllers of Major Importance". The threshold is not a fixed number but a combination of data volume, sensitivity, and processing complexity. Hospitals processing patient health records, biometric identifiers (including NIN), and financial data typically meet the threshold.

Registration involves submitting hospital details, the named DPO, the categories of personal data processed, the legal basis for processing, the data retention periods, and the sub-processor list (any third party that touches the data, including your hospital management system vendor). NDPC publishes guidance on the registration process.

What stayed the same operationally

Five things did not change in substance. If your hospital was already compliant with NDPR, these continue to be the operational requirements:

Lawful basis for processing. The hospital has to have a defined legal basis (consent, contract, vital interests, legitimate interests) for processing each category of personal data. For most health-care processing, the legal basis is the contract of service combined with vital interests.
Role-based access to sensitive data. Not every staff member sees every record. Receptionists see registration data. Doctors see clinical notes for their patients. Pharmacists see prescriptions sent to them. The hospital management system has to enforce this.
Audit logs of access to records. Who accessed which patient's record, when, from which device, and what they did (view, edit, export). The log has to be tamper-resistant and retained for a defined period.
Patient rights of access and correction. Patients can request a copy of their data, ask for corrections, and request deletion in specific cases. The hospital has to respond within the prescribed window.
Cross-border transfer controls. If patient data leaves Nigeria (for example, if your hospital management system stores data in a foreign cloud), the transfer requires either an NDPC-approved adequacy decision, contractual safeguards, or explicit consent. This is why Nigeria-hosted hospital management systems are becoming a procurement preference.

What this means for your hospital management system

Six capabilities your system needs to support under NDPA. Most are the same as under NDPR but the documentation expectations have tightened.

Role-based access control. Each staff role is mapped to specific permissions. A receptionist cannot see lab results. A pharmacist cannot see HR records. The medical director can see all clinical records but not the audit log of their own activities (separation of duties).
Tamper-evident audit log. Every access to every record is logged. The log is cryptographically signed or stored in a way that detects retroactive modification. NDPC inspectors will ask to see a sample of the log during compliance reviews.
NIN encryption at rest and in transit. The NIN is the canonical Nigerian patient identifier. Plain-text storage of NIN is a clear NDPA risk. Encrypt at the database layer and only decrypt at the point of authorised use.
Patient data export. When a patient requests access, the system can produce a structured export of all their data within the prescribed response window. Build the export now; do not wait until the request lands.
Breach detection and response workflow. The system flags anomalous access patterns (large bulk exports, off-hours access from new devices, mass record downloads). The DPO investigates and the 72-hour clock to NDPC notification starts.
Sub-processor list. The system vendor publishes its sub-processor list (cloud provider, backup provider, monitoring services). You include this list in your NDPC registration packet.

Practical NDPA readiness checklist

Six concrete actions a Nigerian hospital should take if they are not yet done:

Appoint a named Data Protection Officer with the qualification, budget, and authority the role requires.
Register with NDPC as a Data Controller of Major Importance, naming the DPO and listing the data categories processed.
Document the legal basis for each category of personal data processing in a Records of Processing Activities (RoPA) document.
Audit your hospital management system's role-based access against the actual job roles in the hospital. Tighten or extend permissions as needed.
Confirm your system encrypts the NIN at rest and in transit, and that the encryption keys are managed (not in plain text on the same server).
Run a tabletop breach response exercise with the DPO, IT lead, medical director, and administrator. Confirm the 72-hour notification process works before you need it.

What good looks like

A Nigerian hospital with a clean NDPA posture can answer five questions for an NDPC inspector or HMO auditor:

Who is the named Data Protection Officer, and what is their qualification and reporting line?
Is the hospital registered with NDPC as a Data Controller of Major Importance? Show the registration certificate.
What is the lawful basis for each category of patient data processing? Show the RoPA document.
How is patient data secured? Show the access control matrix, the audit log sample, and the NIN encryption setup.
What happens in a breach? Show the response workflow with the 72-hour notification chain.

The flagship guide on choosing a hospital management system in Nigeria covers the related compliance points. See Hospital Management System Nigeria: The 2026 Complete Guide for the twelve-point demo checklist. For background on NDPR, NDPA, and NDPC, see the Nigerian healthcare compliance glossary.

Frequently asked questions

Is NDPR still in force in Nigeria?

The NDPR regulation as a primary instrument is largely superseded by NDPA 2023. Many of the operational provisions of NDPR carry forward into NDPA, but NDPA is now the highest-level law and the NDPC is the enforcing regulator. Treat NDPR and NDPA together when scoping compliance; documents and contracts that reference NDPR by name continue to be relevant in substance.

Do all Nigerian hospitals have to register with NDPC?

Hospitals processing significant volumes of patient data (which includes most private hospitals) qualify as Data Controllers of Major Importance and have to register. The threshold is not a fixed patient count but a combination of data volume, sensitivity, and processing complexity. Small clinics with very low patient volumes may fall below the threshold, but for any hospital processing electronic health records, NIN, and HMO claims at meaningful scale, registration is required.

What is the penalty for non-compliance with NDPA?

NDPA 2023 sets out administrative penalties up to 2 percent of annual gross revenue or N10 million (whichever is higher) for serious infringements, and up to 1 percent or N2 million for less serious ones. NDPC also has enforcement powers including investigation, audit, and orders to stop unlawful processing. Beyond penalties, reputational damage from a published breach can be substantial for hospitals.

Does my Data Protection Officer have to be a full-time employee?

The DPO has to be qualified and independent of the line management of the data-processing activities. For larger hospitals, this typically means a dedicated employee. For smaller hospitals, the DPO function can be outsourced to a qualified external consultant, as long as the independence and accessibility requirements are met. NDPC guidance covers acceptable outsourcing arrangements.

How does NDPA affect cloud-hosted hospital management systems?

NDPA permits cross-border transfer of personal data only under specific conditions. Hospital management systems hosted in foreign clouds (AWS US, Azure EU) need either contractual safeguards (typically Standard Contractual Clauses) or an NDPC adequacy decision for the destination country. Many Nigerian hospitals are now expressing a procurement preference for systems hosted in Nigerian or African data centres to simplify the compliance picture.

Does NaijaHealth meet NDPA requirements?

We have built role-based access control, audit logging, NIN encryption at rest and in transit, and patient data export from the platform's first release. Our hosting and sub-processor list is documented and shared on request, and we support hospital DPOs through NDPA registration with NDPC. Talk to us for the current technical posture and documentation packet.

NDPR vs NDPA: what changed for Nigerian hospitals in 2023 (and what to actually do about it)