Picture Ibrahim in Kano, applying for jobs late at night. A job site he found through a Twitter link asks him to upload his CV, NIN slip, passport photograph, BVN and a scan of his WAEC certificate, “for verification”. He uploads everything. Two weeks later, strangers start calling his phone with “loan offers”, and a bank tells him someone tried to open an account in his name. Ibrahim wasn’t careless. He just didn’t know the rules. Data privacy at work matters for everyone: job seekers, employees and anyone handling customer information. This guide explains your rights under Nigerian law and nine practical rules to protect your data.
Data privacy at work means protecting personal information, such as your CV, ID numbers, bank details, salary and health records, and the information of customers and colleagues, when you apply for jobs, use work systems or use AI tools. In Nigeria, the Nigeria Data Protection Act (NDPA) 2023 gives you rights over your personal data and requires organisations to protect it and report serious breaches.
Key takeaways
- The NDPA 2023 protects your personal data and gives you rights over it, including the right to complain to the NDPC.
- Only share sensitive details like your BVN and NIN when there is a clear, legitimate need.
- Never paste customer or colleague data into public AI tools.
- Organisations must report personal data breaches to the NDPC within 72 hours of becoming aware of them.
What the NDPA means for employees and job seekers
The Nigeria Data Protection Act 2023 is Nigeria’s main data protection law, overseen by the Nigeria Data Protection Commission (NDPC). In 2025, the NDPC issued the General Application and Implementation Directive (GAID) to explain how organisations must comply. In simple terms:
- Organisations must tell you what data they collect, why, how they use it and what your rights are.
- They should collect only the data they need for a clear purpose.
- They must keep it secure and notify the NDPC of personal data breaches within 72 hours of becoming aware of them.
- They must notify you promptly if a breach poses a high risk to your privacy.
Your main rights as a data subject
| Right | What it means |
|---|---|
| To be informed | Know who is collecting your data and why |
| Access | Ask for a copy of the personal data an organisation holds about you |
| Rectification | Ask them to correct wrong information |
| Erasure | Ask for your data to be deleted in certain situations |
| Data portability | Receive your data in a usable format in certain cases |
| Object and withdraw consent | Object to some uses, and withdraw consent you gave |
| Complain | Lodge a complaint with the NDPC |
For the basics of online privacy, read our guide on online privacy and the NDPA.
9 practical data privacy rules at work
- Keep your CV lean. Leave out your BVN, NIN, date of birth, full home address and religion. Phone, email, city and LinkedIn are usually enough.
- Share ID documents only after a real offer. Legitimate employers usually ask for NIN, BVN or certificates during onboarding, not at the first application.
- Check who is asking. Before uploading documents, confirm the company is real and the website is its official one. See our guide on how to avoid online scams.
- Read the privacy notice. What will they do with your data, and for how long?
- Never share passwords or one-time codes, even with IT “support” or colleagues.
- Use strong, unique passwords and two-factor authentication on work and personal accounts.
- Don’t paste personal data into public AI tools. Remove names, phone numbers, account details and staff records before asking AI for help.
- Lock and protect devices. Use screen locks, don’t leave laptops unattended and be careful on public Wi-Fi.
- Report problems quickly. If you suspect a leak or a scam, tell your manager, IT or data protection officer immediately.
What never to put into AI tools at work
- Customer names, phone numbers, addresses and account details.
- BVNs, NINs and card numbers.
- Staff records, salaries, disciplinary or health information.
- Contracts, passwords and confidential business plans.
Use placeholders such as “Customer A”, and only use AI tools your employer has approved.
Protecting your data on job sites and remote platforms
- Use well-known job boards and official company career pages.
- Be wary of sites that ask for BVN, NIN or bank details at sign-up.
- Keep freelance and remote-work profiles professional, without personal ID numbers.
- Delete accounts on sites you no longer use.
What to do after a data leak
- Change passwords on affected accounts and turn on two-factor authentication.
- Tell your bank if financial details may be exposed, and watch your accounts for unusual activity.
- Be alert to scams. Leaked data is often used for convincing phishing calls and messages.
- Ask the organisation what happened and what data was affected.
- Complain to the NDPC if the organisation doesn’t respond properly.
- Report fraud to the police or EFCC if your data is used to commit a crime.
Try this this week
Open your CV and remove anything that isn’t needed: BVN, NIN, date of birth and full home address. Then turn on two-factor authentication for your email and LinkedIn accounts.
Frequently asked questions
What are my data rights under the NDPA?
Under the Nigeria Data Protection Act 2023, you have rights to be informed about how your data is used, to access it, to correct it, to request erasure in certain cases, to data portability in certain cases, to object to some processing and withdraw consent, and to complain to the Nigeria Data Protection Commission.
Is it safe to send my NIN to employers?
It can be, when a verified employer needs it for a legitimate purpose, usually during onboarding after a real job offer. Be cautious about sharing your NIN or BVN at the application stage or with websites you can’t verify. Ask why it’s needed and how it will be protected.
What should I do if my data is leaked?
Change your passwords, turn on two-factor authentication, alert your bank if financial details are exposed and watch for scam calls and messages. Ask the organisation what happened, and complain to the NDPC if you don’t get a proper response. Report any fraud to the police or EFCC.
Final thoughts
Your personal data is valuable, to you, and unfortunately to scammers too. The NDPA gives you real rights, but the first line of defence is your own habits. Share less, check more, protect your accounts and keep other people’s data as safe as you’d want yours to be.
Learn the basics of your rights with our NDPA guide, and join the Mindset.ng newsletter for weekly practical guides.
Related reading
Sources
- Nigeria Data Protection Commission. Nigeria Data Protection Act 2023: General Application and Implementation Directive (GAID) 2025.
- Nigeria Data Protection Commission. Official website.
Written and fact-checked by the Mindset.ng Editorial Team in line with our Editorial Policy. This article is for general information only and is not legal advice. Requirements change, so always confirm current details with the official body or a qualified professional. Last updated: 25 September 2026.
