Nigeria Data Protection Regulation (NDPR) IF-3.2(ix), 9.2-9.3: Notify NITDA of personal data breaches within 72 hours with the eight required details

Controllers must self-report personal data breaches to NITDA within 72 hours of knowledge, a timeline to be documented in the data protection and privacy policies. The notification must describe the circumstances, the date or period, the personal information involved, the assessed risk of harm, an estimate of individuals at real risk of significant harm, steps taken to reduce harm, steps taken to notify individuals, and a contact person for NITDA's questions.