NDPA data breach 72 hours: what staff must do

The NDPA data breach 72 hours rule is simple to say and hard to meet. A laptop goes missing. A file goes to the wrong person. Someone clicks a bad link. The clock can start before leadership even hears about it.

That is why every staff member needs to know what to do in the first hour.

This is a plain-words guide, not legal advice. Check the Act and talk to your data protection lead.

What is the NDPA 72 hour breach rule?

A controller must tell the NDPC within 72 hours of becoming aware of a breach that risks people’s rights and freedoms. That is section 40(2) of the Nigeria Data Protection Act 2023.

A law-firm summary from Afriwise lays out section 40 like this:

• A processor that learns of a breach must tell the controller who hired it (s. 40(1)).
• A controller must tell the NDPC within 72 hours of becoming aware, if the breach risks people’s rights and freedoms (s. 40(2)).
• If the risk to people is high, the controller must tell those people “immediately” and say what they can do to limit harm (s. 40(3)).
• If you do not yet have all the facts, you may report in phases.
• Controllers must keep records of all breaches: the facts, the effects and what was done.

The NDPC website also has a service to report a breach. Read the Act and the NDPC’s GAID 2025 guidance for the exact text.

When does the 72-hour clock start?

It starts when your organisation becomes aware of the breach. It does not start when the breach happened.

That is a trap. If a staff member knows on Monday and tells no one until Friday, your organisation may already be late. Fast internal reporting is how you protect the deadline.

What counts as a data breach at work?

A breach is any event that exposes personal data to people who should not see it, or loses it. Examples:

• A lost or stolen laptop or phone with customer data.
• An email with customer or staff data sent to the wrong person.
• A phishing click that gave away a password.
• A shared file link open to anyone.
• A vendor tells you they were hacked.
• A staff member shares a customer list on a personal WhatsApp group.

Most of these are small mistakes, not attacks. They still count.

What should staff do in the first hour of a breach?

Stop, tell one named person, and write down the facts. Do not try to fix it alone and do not delete anything.

Hour 0 to 1: staff

1. Stop. Do not delete anything.
2. Tell your manager or the named security contact. Use the phone or the agreed channel.
3. Write down what happened, the time, and what data was involved.

Hour 1 to 24: lead and IT

4. Contain it: reset passwords, remove access, lock the device.
5. List what data and how many people may be affected.
6. Decide if people are at risk. Write the reason down.

Hour 24 to 72: lead

7. If reportable, notify the NDPC. Send what you know. Add details in phases.
8. If the risk to people is high, tell them plainly and what to do.
9. Keep a record: who, what, when, and what you changed.

Who decides if a breach must be reported?

Your data protection officer or named lead decides, not the person who found the problem. Staff just report.

This is the most useful split to teach. It takes fear out of the first hour. A cashier does not need to weigh up the law. They need to make one phone call.

What should a breach report to the NDPC include?

Be ready to say what happened, which kinds of data, roughly how many people, who your contact is, and what you have done. One legal summary lists these items. Check the current NDPC form for the exact fields.

If you do not have everything yet, report what you know. The Act lets you add the rest in phases. Late and complete is worse than on time and partial.

A worked example

At 9:15 on Monday, a sales officer sends a spreadsheet of 400 customer names and phone numbers to the wrong email address.

• 9:20: She tells her manager and does not try to “recall” and hide it.
• 9:40: IT asks the receiver to delete it, and the lead writes down the time and facts.
• By Tuesday: The lead decides if the risk to those 400 people is real, and writes the reason.
• If yes: The lead reports to the NDPC well inside 72 hours.

Even if the answer is “no report needed”, the record of how you decided is what protects you later.

The one rule for staff

“If you are not sure, report it. We would rather hear about 10 small problems than miss one big one.”

Make that a no-blame rule. People hide mistakes when they fear punishment, and the clock keeps running.

Make it a habit, not a poster

• Name one person and one phone number for breaches. Put them on every desk.
• Run a 15-minute drill twice a year.
• Add the breach steps to onboarding for every new hire.
• Train all staff on how to spot and report. See our NDPA staff training page and the NDPA staff training checklist.

If the first sign is often a phishing click, read Clicked a phishing link at work? Do these 7 things. To spot the common Nigerian scams early, see BVN and OTP scams at work.

Want your team ready before it happens?

Staff who have practised reporting do it faster. See our courses, the phishing simulation program, or book a free demo.