By Jackson Goodwin, Cybersecurity Analyst · Penetration Tester. Email info@jacksontechnology.com.ng

Under Nigeria's data protection law, you have just three days from discovery to report a breach to regulators. Most organisations have no plan. Here is how to build one before the clock starts ticking

What Is Nigeria's 72-Hour Rule?

In April 2019, Nigeria's National Information Technology Development Agency (NITDA) released the Nigeria Data Protection Regulation (NDPR) — the country's first comprehensive data protection framework. Among its most operationally demanding requirements is a mandatory breach notification timeline that has caught many Nigerian organisations off guard.

Under Section 3.2 of the NDPR, any data controller or processor that experiences a personal data breach is required to notify NITDA — and, in many cases, the affected data subjects — within 72 hours of becoming aware of the breach. This is not a target. It is not a guideline. It is a compliance obligation with real financial and reputational consequences for failure.

⚠ CRITICAL REQUIREMENT

The 72-hour clock begins from the moment your organisation becomes aware of a breach — not from when it happened, and not from when you finish investigating. Delayed internal escalation is the most common reason organisations miss the window.

The NDPR draws significant inspiration from Europe's General Data Protection Regulation (GDPR), which operates an identical 72-hour notification requirement for supervisory authorities. Nigeria's adoption of this standard signals its intent to align with global data protection best practice — and places the same operational demands on Nigerian organisations that European businesses have faced since 2018.

What Counts as a Notifiable Breach?

Not every security incident requires NITDA notification. Understanding the threshold is critical — both to avoid under-reporting (a compliance failure) and unnecessary over-reporting that wastes regulatory goodwill. Under the NDPR, a notifiable breach is one that is likely to result in a risk to the rights and freedoms of natural persons.

In practical terms, this includes but is not limited to:

• Unauthorised access to personal data stored on your systems — whether by external hackers or internal insiders
• Accidental disclosure of personal data to the wrong recipient via email, messaging platforms, or file sharing
• Ransomware or malware attacks that encrypt personal data and render it unavailable to its rightful controllers
• Loss or theft of a device — laptop, USB drive, mobile phone — containing unencrypted personal data
• Exposure of customer databases through misconfigured cloud storage buckets or insecure APIs
• Systematic interception of personal data in transit due to absent or broken encryption

// Legal Context

If a breach involves sensitive personal data — health records, financial information, biometric data, or data relating to children — the notification obligation is absolute, regardless of assessed risk level. Err on the side of notification when in doubt.

Penalties for Non-Compliance

The NDPR prescribes financial sanctions that are significant enough to demand the attention of every board and C-suite in Nigeria. NITDA has demonstrated a clear willingness to exercise its enforcement powers — issuing high-profile fines to major organisations that failed to meet the regulation's requirements.

Violation	Organisation Type	Maximum Penalty	Risk Level
Failure to notify breach within 72 hours	Large Organisation	₦10,000,000 or 2% of Annual Gross Revenue	CRITICAL
Failure to notify breach within 72 hours	SME / Small Entity	₦2,000,000 or 2% of Annual Gross Revenue	HIGH
No data protection policy in place	All Organisations	₦2,000,000 minimum	HIGH
Inadequate breach response documentation	All Organisations	Regulatory action + audit	MEDIUM
Timely, complete notification submitted	All Organisations	Mitigating factor in enforcement	COMPLIANT

"The cost of a data breach response plan is measured in hours. The cost of not having one is measured in millions of naira — and far greater damage to customer trust."— Jackson Goodwin, Cybersecurity Analyst

Building Your Data Breach Response Playbook

A data breach response playbook is a documented, pre-approved set of procedures that your organisation follows the moment a suspected breach is identified. Its purpose is to eliminate hesitation, compress decision-making time, and ensure that the right people take the right actions within the 72-hour window — without confusion, guesswork, or missed steps.

Here are the seven foundational components every Nigerian organisation's playbook must contain:

1. Detection & Initial Triage Procedures: Define how your organisation identifies a potential breach — through SIEM alerts, helpdesk tickets, third-party notifications, or staff reports. Establish a triage checklist that any team member can follow to determine whether the incident meets the notifiable threshold. Speed here is everything: the 72-hour clock starts at awareness, so slow internal escalation is itself a compliance failure.
2. Defined Escalation Paths & RolesName names. Your playbook must specify exactly who is notified first (typically your Data Protection Officer or IT Security Lead), who has authority to declare a breach formally, and who owns communication to NITDA. Ambiguity about responsibility is the most common cause of missed deadlines. Every role should have a named primary and a named backup.
3. Containment & Evidence Preservation Protocols. Before you can report accurately, you need to stop the bleeding. Your playbook must include immediate containment steps — isolating affected systems, revoking compromised credentials, blocking malicious traffic — while simultaneously preserving logs, screenshots, and forensic evidence. Containment and investigation must happen in parallel, not sequentially.
4. Impact Assessment Framework: How many data subjects are affected? What categories of personal data were compromised? What is the likely consequence for individuals — financial fraud risk, identity theft, physical harm? A structured impact assessment template allows your team to answer these questions rapidly and populate the NITDA notification accurately.
5. NITDA Notification Template: Pre-draft your regulatory notification. NITDA requires specific information in breach reports — and completing this under time pressure without a template is an invitation to errors or omissions. Your template should include: nature of breach, categories and volume of data affected, likely consequences, and remediation measures taken or planned.
6. Data Subject Communication PlanWhen affected individuals must be informed, your playbook should include pre-approved communication templates — email, SMS, and public notices — that are clear, accurate, and legally reviewed. Avoid vague corporate language. Affected individuals deserve specific, actionable information about what happened and what they should do to protect themselves.
7. Post-Incident Review & Remediation ProcessEvery breach — successfully managed or not — is a learning opportunity. Your playbook must mandate a structured post-incident review: root cause analysis, identification of control failures, and a remediation roadmap with assigned ownership and deadlines. NITDA may request evidence of your remediation actions during follow-up audits.

The 72-Hour Action Timeline

Time management is the defining challenge of breach response. Here is how the 72-hour window should be structured in your playbook — with clear milestones at each stage.

Hour 0–2 · Detection

Confirm and Escalate

The incident is identified by monitoring systems, a staff member, or a third party. Immediate triage confirms it is likely a personal data breach. The Data Protection Officer and IT Security Lead are notified. The formal clock is now running.

Hour 2–12 · Containment

Stop the Breach, Preserve Evidence

Affected systems are isolated. Compromised credentials are revoked. Forensic preservation of logs begins. The incident response team convenes. A preliminary scope assessment is completed — how many records, what data categories, what likely impact.

Hour 12–36 · Assessment

Determine Notifiability and Scope

A formal determination is made: is this a notifiable breach under the NDPR? Impact assessment is completed. Legal counsel is engaged. The NITDA notification is drafted using your pre-approved template and reviewed by your DPO and Legal team.

Hour 36–72 · Notification

Submit to NITDA and Notify Data Subjects

The formal breach notification is submitted to NITDA through the designated channel. Affected data subjects are notified where required. All actions, decisions, and communications are documented contemporaneously for the regulatory record.

Hour 72+ · Recovery

Remediate, Review, and Report

Full system recovery and hardening begins. A post-incident review is scheduled within 14 days. Remediation actions are documented and assigned. A final incident report is prepared for senior leadership and the board.

Assembling Your Incident Response Team

A playbook without people is a document. Your incident response team should be pre-identified, trained on the playbook, and contactable outside business hours. At minimum, your team should include:

• Data Protection Officer (DPO)— the regulatory focal point; responsible for the NITDA notification decision and submission
• IT Security Lead / CISO— technical containment, forensic preservation, and impact assessment of ownership
• Legal Counsel— reviews all external communications and advises on regulatory exposure and notification obligations
• Communications / PR Lead— manages public and media communications if the breach becomes publicly known
• Executive Sponsor (CEO / COO)— provides authority for significant decisions such as service suspension or public disclosure
• External Cybersecurity Consultant— for organisations without an in-house forensic capability, a retained external specialist should be pre-contracted

✓ Best Practice

Conduct a tabletop exercise with your full incident response team at least once per year. Walking through a simulated breach scenario identifies gaps in your playbook before a real incident exposes them. It also ensures every team member knows their role under pressure.

What to Include in Your NITDA Breach Notification

When the 72-hour window requires you to submit a notification to NITDA, the report must contain sufficient detail to allow the regulator to assess the severity of the breach and the adequacy of your response. Based on the NDPR requirements and NITDA's published guidance, your notification should cover:

• The nature of the breach— how it occurred, which systems were affected, and the attack vector, where known
• The categories and approximate volume of personal data involved — how many records, what types (financial, health, identity)
• The likely consequences for affected individuals — financial fraud risk, discrimination risk, physical risk, or reputational harm
• The measures taken or proposed to contain, remediate, and prevent recurrence
• The contact details of your Data Protection Officer or the designated point of contact for further correspondence
• Where notification to data subjects has been delayed, the reasons for the delay and the anticipated notification timeline

If all the required information is not yet available at the 72-hour mark, it is permissible to submit an initial notification with available information, followed by supplementary details as your investigation progresses. Submitting an incomplete notification on time is far preferable to submitting a complete notification late.

Prevention: The First Line of Defence

A breach response playbook is your organisation's plan for when things go wrong. But the most cost-effective strategy is to prevent the breach from occurring in the first place. As a cybersecurity analyst and penetration tester, I work with organisations across Nigeria to identify and close the vulnerabilities that lead to reportable breaches — before they are exploited.

The most common vulnerabilities I uncover that lead to NDPR-notifiable breaches include: unpatched systems exposed to the internet, weak or reused employee credentials, misconfigured cloud storage with public access, insufficient access controls on databases containing personal data, and the absence of encryption for data in transit and at rest.

Each of these is detectable — and fixable — through a structured penetration test before an attacker finds them. An annual penetration test, combined with a documented breach response playbook, represents the minimum security baseline for any Nigerian organisation processing personal data at scale.

// Regulatory Reminder

The NDPR applies to any organisation — Nigerian or foreign — that processes the personal data of Nigerian citizens. If your organisation operates in Nigeria or serves Nigerian customers, you are subject to these requirements regardless of where your servers are located.

Conclusion: Compliance Is a Process, Not an Event

Nigeria's 72-hour data breach notification requirement is one of the most operationally demanding provisions in the NDPR — and one of the most frequently violated. Organisations that treat it as a distant compliance checkbox discover its urgency only in the worst possible moment: in the middle of a live breach, with regulators waiting and customers at risk.

The organisations that handle breaches well — that notify on time, communicate clearly, and remediate effectively — are the ones that built their playbooks long before they needed them. They trained their teams, ran their exercises, and engaged their security partners before the clock started ticking.

Do not let the first time your organisation activates its breach response playbook be the first time you discover you do not have one.

Is Your Organisation Breach-Ready?

I help Nigerian businesses assess their NDPR compliance posture, build incident response playbooks, and identify the vulnerabilities that lead to notifiable breaches — through professional penetration testing and security consultancy. Request a Breach Readiness Assessment, or email directly: info@jacksontechnology.com.ng