Parent Financial Data and the NDPA: What Nigerian Schools Are Actually Obligated to Do

Nigerian schools hold a meaningful amount of financial information about parents — bank details, payment history, outstanding balances, sometimes BVN or account numbers passed along for verification. The Nigeria Data Protection Act (NDPA), signed into law in 2023, governs how that information has to be handled, and it's worth being precise about what it actually says rather than assuming it mirrors Europe's GDPR line for line. The two laws share a family resemblance, but the NDPA has its own specific obligations, its own regulator, and — as of 2025 — its own active enforcement pattern that schools shouldn't assume doesn't apply to them.

What the NDPA actually requires, in plain terms

The NDPA applies to any organisation processing the personal data of people in Nigeria, and a parent's name, contact details, payment records, and account information all count as personal data under it, regardless of whether the organisation is a bank, a business, or a school. The Act sets out general data protection principles any data controller (which is what a school is, in relation to its parents' data) has to follow: data should be collected for a clear, legitimate purpose and not reused beyond that purpose, kept no longer than necessary, kept accurate, and secured appropriately against unauthorised access or loss. These obligations apply to parent financial data by default — there's no exemption for schools as a category, and no minimum size below which the general principles stop applying.

Separately, the Nigeria Data Protection Commission (NDPC) issued a General Application and Implementation Directive in 2025 that adds more concrete, recurring obligations on top of the Act itself — according to secondary summaries of the directive, organisations are expected to run a compliance audit within 15 months of starting operations and then annually, maintain a privacy policy that's actually visible wherever data is collected, and (for organisations designated "of major importance," a category tied to the volume or sensitivity of data processed rather than to organisation type) register with the NDPC, appoint a data protection officer, and file compliance reports on a schedule. Whether a given school size or data volume crosses into the "major importance" tier is a determination the NDPC itself makes, not something a school can self-assess from a blog summary — worth confirming directly against current NDPC guidance rather than assuming either way.

One specific obligation worth knowing by name: under the Act, a data controller that suffers a data breach likely to put individuals' rights at risk is required to notify the NDPC within 72 hours of becoming aware of it, and to notify the affected individuals as well where the breach poses a real risk to them. For a school, this would cover a leak or unauthorised access involving parents' financial or payment records specifically — the 72-hour clock is a real, named deadline under the Act, not a best-practice suggestion.

An important nuance: financial data and "sensitive personal data" aren't the same category

It's worth being precise here rather than assuming financial information automatically gets the Act's strictest protection. The NDPA defines a narrower "sensitive personal data" category that carries extra processing conditions, and based on secondary legal commentary, that category is built around genetic and biometric data, race or ethnic origin, religious belief, health status, sex life, political opinion, and trade union membership — not financial or payment information as such. (Some commentary also debates whether criminal-record data belongs in that list, which is itself a sign this area has some genuine ambiguity worth checking against the Act's actual text rather than a summary.)

That doesn't mean a parent's payment data falls outside the Act — it's still ordinary personal data and still fully subject to the general obligations above (purpose limitation, security, breach notification, and so on), just not the extra layer of conditions reserved for the sensitive category. Practically, this means a school's main NDPA exposure around fee data is less about a special "financial data" rule and more about the basic blocking and tackling: who inside the school can actually see a parent's account details, how long that data is kept, whether it's secured against unauthorised access, and whether the school has told parents, clearly, what it collects and why.

Where schools commonly fall short, and why a vendor's practices matter

• No real privacy notice — parents are rarely told in writing what financial data the school collects, why, who can see it, and how long it's kept, which is a basic transparency obligation rather than an optional courtesy.
• Financial records accessible more broadly than necessary — a spreadsheet or shared folder with every parent's payment history, visible to more staff than actually need it for their role, is a common gap that has nothing to do with malice and everything to do with how these records tend to accumulate informally over time.
• No defined retention period — payment and balance records for students who left years ago often just sit indefinitely because no one decided when they should be deleted or archived.
• No real plan for what happens if a breach occurs — the 72-hour notification clock under the Act starts running the moment a school becomes aware of a breach, which is a hard deadline to meet if there's no process for recognising and escalating one in the first place.

The NDPC's enforcement activity has moved well past a single sector: it issued compliance notices to over 1,300 organisations across financial services, insurance, and gaming in 2025, and separately issued notices to over 600 Nigerian tertiary institutions specifically over student and staff data handling in early 2026. Neither of those enforcement rounds targeted basic/secondary schools directly as far as this research found, but the direction is clearly toward broader sectoral enforcement, not away from it — a school assuming it's too small or too far from the regulator's attention to matter is making an assumption the recent pattern doesn't really support.

This is also why a school's choice of payment or fee-management vendor isn't purely a feature decision — a school remains the data controller for its parents' financial information even when a vendor's system is what actually stores and processes it, so a vendor's own data-handling practices (who can access payment records, how long they're retained, whether the vendor itself has a credible security and privacy posture) become the school's exposure too. Asking a vendor directly how parent financial data is protected and for how long it's retained is a reasonable, specific question to ask before signing up with any fee platform — not a technical detail to defer to "the IT people."

Related questions