Nigeria Data Protection Act

NDPA overview#

What this means: Nigeria has its own data protection law. We follow it.

The Nigeria Data Protection Act 2023 came into force on 14 June 2023 and is supervised by the Nigeria Data Protection Commission, the statutory regulator established by the same Act. The NDPA replaces the earlier Nigeria Data Protection Regulation 2019 and substantially aligns Nigerian practice with global standards such as the European Union General Data Protection Regulation.

The Act sets six core principles for processing personal data. Processing must be fair, lawful, and transparent. It must be for a specified, explicit, and legitimate purpose. It must be adequate, relevant, and limited to what is necessary. It must be accurate and kept up to date. It must be kept in a form that allows identification for no longer than necessary. It must be processed in a manner that ensures appropriate security.

MiTax operates under these principles for every personal data processing activity, whether the data subject is a personal taxpayer, a registered business owner, an employee processed through a corporate payroll, or a State Internal Revenue Service partner.

MiTax as Data Controller#

What this means: MiTax decides why and how your data is processed. That makes us the Controller.

MiTax determines the purposes and means of processing personal data collected through the service. Under the NDPA, this designates MiTax as the Data Controller.

Where MiTax processes personal data on behalf of a corporate client, for example payroll data submitted by an employer running PAYE through MiTax Pro, MiTax acts as a Data Processor for that subset of data, and the employer remains the Controller. A separate Data Processing Agreement governs that relationship.

Where MiTax processes personal data on behalf of a State Internal Revenue Service through a MiTax State white-label deployment, the State is the Controller for taxpayer data within the State, and MiTax operates as Processor under a written agreement that complies with section 29 of the NDPA.

Lawful basis for processing#

What this means: we always have a reason from the NDPA list to process your data.

Section 25 of the NDPA lists the lawful bases on which personal data may be processed. MiTax relies on the following bases, depending on the activity.

• Consent. For optional features such as marketing emails, WhatsApp broadcast updates, and analytics cookies that are not strictly necessary, we ask for explicit, granular, freely given consent that can be withdrawn at any time.
• Performance of a contract. For core service delivery, including account creation, tax calculation, filing, and payment processing, we process data because doing so is necessary to perform the contract that you entered into when you accepted our Terms.
• Compliance with a legal obligation. For Know Your Customer verification, anti-money-laundering checks, retention of tax records for six years, and disclosure to the Nigeria Revenue Service, we process data because Nigerian law compels us to.
• Legitimate interests. For security monitoring, fraud detection, internal audit, and product improvement using aggregated data, we rely on legitimate interests after balancing them against your rights and freedoms.

We document the lawful basis for each processing activity in our internal Record of Processing Activities, which we make available to the Nigeria Data Protection Commission on request.

Data subject rights#

What this means: the NDPA gives you eight rights. Here they are, with how to use each.

Under Part V of the NDPA you have the following rights as a data subject.

• Right to be informed about what data we collect, why, and with whom we share it. We meet this right through our Privacy Policy and this Compliance Statement.
• Right of access to confirmation that we process your data, a copy of the data, and the information listed in section 34 of the NDPA. Request a Subject Access Report by emailing the Data Protection Officer.
• Right to rectification of inaccurate or incomplete data. Most fields can be edited inside the app. For locked fields such as Tax Identification Number, email the Data Protection Officer.
• Right to erasure where retention is no longer lawful. We delete data unless retention is required by Nigerian tax law or by a court order, in which case we explain the lawful basis for the hold.
• Right to restriction of processing while accuracy or lawful basis is being reviewed.
• Right to data portability in a structured, commonly used, machine-readable format. We provide a one-click export of your filings and financial records as JSON and CSV.
• Right to object to processing based on legitimate interests or to direct marketing. Marketing objection takes effect immediately.
• Right not to be subject to automated decisions that produce legal effects, including profiling. MiTax does not make legal-effect decisions purely by automated means. A human can always review.

To exercise any right, email dpo@mitax.io. We verify your identity, respond within thirty calendar days, and do not charge for the first request in any twelve month period.

Data Protection Officer#

What this means: there is a single inbox for every data-protection request, and it is monitored.

Section 32 of the NDPA requires data controllers of major importance to appoint a Data Protection Officer. Because of the volume and sensitive financial nature of the data MiTax processes, we expect to meet that threshold and are appointing a Data Protection Officer as part of our NDPA compliance programme.

The Data Protection Officer role is responsible for monitoring compliance with the NDPA, advising the company on its obligations, training staff, and serving as the contact point for data subjects and the Nigeria Data Protection Commission, independently of product and engineering management.

Every data-protection enquiry (access, correction, deletion, or a complaint) goes to dpo@mitax.io, which is monitored and answered.

Data breaches#

What this means: if your data is exposed, we tell the regulator within 72 hours and we tell you without undue delay.

Section 40 of the NDPA requires controllers to notify the Nigeria Data Protection Commission of a personal data breach within seventy-two hours of becoming aware of it, where the breach is likely to result in a risk to the rights and freedoms of data subjects.

MiTax maintains a documented incident response plan. On detection of a suspected breach, the on-call engineer escalates to the Data Protection Officer and the security lead within one hour. A breach severity assessment is completed within twenty-four hours. Notification to the Commission is issued within seventy-two hours where the threshold is met.

Affected users are notified by email and in-app alert without undue delay, in plain language, with a description of what happened, what data was involved, what we are doing, and what they can do.

Significant incident notices are published through the MiTax app and official support channels, with a plain-language summary after resolution where disclosure is appropriate.

Cross-border transfers#

What this means: we store data in London and back it up to the EU. Both regions have laws considered adequate.

Section 43 of the NDPA regulates transfers of personal data to countries outside Nigeria. Transfers are permitted to jurisdictions that the Nigeria Data Protection Commission has determined provide an adequate level of protection, or on the basis of approved safeguards such as standard contractual clauses, binding corporate rules, or explicit informed consent.

MiTax stores primary application data in the United Kingdom and replicates encrypted backups within the European Union. The Nigeria Data Protection Commission has indicated that both jurisdictions provide an adequate level of protection under section 43(2)(a) of the NDPA.

Where a sub-processor operates outside an adequate jurisdiction, MiTax executes standard contractual clauses approved by the Commission and conducts a Transfer Impact Assessment before the engagement begins.

NDPC registration status#

What this means: we are registering with the Nigeria Data Protection Commission, as the Act requires for a business that handles data like ours.

Because of the volume and sensitivity of the personal data MiTax processes, we expect to qualify as a Data Controller of Major Importance under the NDPA. We are completing registration with the Nigeria Data Protection Commission and putting the required annual compliance-audit process in place.

For the current status of our registration, or to raise a data-protection question, email dpo@mitax.io.

Children’s data#

What this means: MiTax is not for under-sixteens. We do not knowingly process their data.

Section 31 of the NDPA prescribes heightened protections for the processing of children’s data. MiTax does not target users under sixteen and the service is not designed for child users. A parent or guardian who discovers a child account should contact dpo@mitax.io and we will close the account and delete the data unless retention is required by law.

Complaints to NDPC#

What this means: if we get it wrong and our response does not satisfy you, you can go to the regulator.

You have the right to lodge a complaint with the Nigeria Data Protection Commission if you believe MiTax has infringed your rights under the NDPA. We encourage you to contact our Data Protection Officer first so that we have a chance to resolve the issue, but this is not a precondition to a complaint.

The Commission accepts complaints through its website at ndpc.gov.ng, by email, and by post to its Abuja headquarters. The Commission may investigate, mediate, issue compliance orders, and impose administrative fines of up to two percent of annual gross revenue for serious infringements.

Contact#

What this means: NDPA questions go to dpo@mitax.io.

For any question about this Compliance Statement or about MiTax under the Nigeria Data Protection Act, email our Data Protection Officer at dpo@mitax.io or write to MiTax, 15 Harbour Road, Onne, Rivers State, Nigeria.

Read alongside the Privacy Policy and the Terms of Service.