Nigeria Data Protection Regulation (NDPR) 4.1(5): Initial audit of privacy and data protection practices with the ten required contents

Within six months of the Regulation's issuance each organisation had to conduct a detailed audit of its privacy and data protection practices stating at least: (a) the personally identifiable information collected on employees and the public; (b) the purposes of collection; (c) notices given to individuals; (d) access given to individuals to review, amend, correct, supplement or delete their information; (e) whether and how consent is obtained before collection, use, transfer or disclosure; (f) security policies and practices; (g) policies and practices for proper use; (h) privacy and data protection policies and procedures; (i) procedures for monitoring and reporting violations; and (j) procedures for assessing the impact of technologies on the stated privacy and security policies.