Protect · Cybersecurity
The technical side of data protection
The Nigeria Data Protection Act 2023 expects organisations to protect personal data with appropriate technical and organisational measures. Kenya’s Data Protection Act 2019, Ghana’s Data Protection Act 2012 and South Africa’s POPIA set similar expectations. We handle the technical part: knowing where data lives, who can reach it, how long it is kept and what happens if something goes wrong.
The problem we solve
Policies need systems behind them
A privacy policy says what you promise. Your systems decide whether you keep the promise: who can open a customer record, whether old data is ever deleted, and whether you would notice a breach in time to report it.
We work alongside your data protection officer, lawyers or compliance organisation to build those promises into your technology.
What you get
Technical measures that stand up
Data mapping
A practical inventory of the personal data you hold, where it is stored, who uses it and where it is sent, including across borders.
Access control
Least-privilege access, multi-factor sign-in, and records of who viewed or changed sensitive data.
Encryption and security
Encryption in transit and at rest, secure configuration and the other safeguards the NDPA expects.
Retention and deletion
Retention rules built into your systems, so data is deleted or anonymised when it is no longer needed.
Breach readiness
Detection, logging and a tested response plan, so a breach can be assessed and reported in time.
Privacy by design
Consent capture, data minimisation and privacy settings designed into new applications from the start.
Working with your advisers
Your technical partner, not your lawyer
Data protection is both a legal and a technical discipline. Legal interpretation and compliance audits belong with your lawyers and a licensed Data Protection Compliance Organisation. We make the technical measures real and give them the evidence they need.
- Technical input to data protection impact assessments
- Evidence of security measures for your annual compliance audit
- Help with data subject requests: finding, exporting and deleting a person’s data
- Technical review of vendors and transfers outside Nigeria
How it works
How we help
Discover
Workshops and system reviews to map personal data and how it flows.
Assess
Gaps against the technical expectations of the NDPA and the NDPC’s guidance, prioritised by risk.
Implement
Access, encryption, retention, logging and consent changes made in your systems.
Evidence
Documentation and records your advisers can rely on, kept up to date as things change.
This service covers technical measures. It is not legal advice, and Y Dynamics is not a licensed Data Protection Compliance Organisation. We are happy to work with yours.
Questions
Frequently asked questions
Does the NDPA apply to us?
If you collect or use personal data about people in Nigeria, such as customers, staff, patients or students, it very likely does. Your lawyer or data protection officer can confirm your obligations, including whether you must register with the Nigeria Data Protection Commission.
What does the NDPA say about breaches?
Data controllers must notify the Nigeria Data Protection Commission within 72 hours of becoming aware of a breach that is likely to put people’s rights and freedoms at risk, and in some cases tell the people affected. That is only possible if you can detect and assess a breach quickly, which is where we help.
Can we keep using cloud services based outside Nigeria?
Usually, yes, but transfers of personal data outside Nigeria need a lawful basis, such as adequate protection in the destination or appropriate safeguards. We document where your data goes so your advisers can confirm the basis.
What is privacy by design?
Building protection into a system from the start: collecting only the data you need, limiting who can see it, keeping it only as long as necessary, and making consent and preferences easy to manage.
Related services
Often paired with
Tell us what you need
Share a few details and we will reply by email with questions, next steps and, where it helps, a short call.