Nigeria Data Protection Regulation (NDPR)

Part Two: principles, consent, policy, security and transfers – Nigeria Data Protection Regulation (NDPR)

Nigeria Data Protection Regulation (NDPR) 2.1(1)(c): Store personal data only as long as reasonably needed

Personal data must be stored only for the period within which it is reasonably needed. (The Implementation Framework, paragraph 8, sets default retention periods where contract or law is silent.)

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Other controls in Part Two: principles, consent, policy, security and transfers – Nigeria Data Protection Regulation (NDPR)

2.1(1)(a) Specific, legitimate and lawful purpose; limits on further processing
2.1(1)(b) Adequate and accurate data, processed without prejudice to human dignity
2.1(1)(d) Secure personal data against foreseeable hazards and breaches
2.1(2)-(3) Duty of care and accountability of whoever holds personal data
2.11 Transfer abroad only to jurisdictions with an adequacy decision, under HAGF supervision
2.12 Transfers without adequacy only on the six derogations, with clear warnings
2.2 Process only on one of the five lawful bases
2.3(1) Tell the data subject the specific purpose before obtaining data

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All Nigeria Data Protection Regulation (NDPR) controls