What Nigerian data-protection law asks of a hospital that keeps records

If your practice holds patient records, you are a data controller. That was true before 2023 and it is truer now, because the instrument you are measured against has changed and a good deal of the compliance advice still circulating has not caught up.

This is a summary written for a practice manager, not legal advice, and the last section is a question the sources leave genuinely open. Where a figure or an obligation matters to a decision you are about to make, read the instrument itself (every one of them is linked at the foot of this page) and take advice.

The instruments that actually bind you

Three documents matter, and only three.

The Nigeria Data Protection Act 2023 is the statute. The General Application and Implementation Directive 2025, signed on 20 March 2025 and referenced NDPC/NDP ACT-GAID/01/2025, is the Commission's directive under it, and it is where almost all of the operational detail lives. Alongside them sits the National Health Act 2014, which governs health records specifically and is older than either.

One thing to check before you read anything else: the directive's Article 3(3) says that on its issuance the Commission ceases to apply the Nigeria Data Protection Regulation 2019 as a legal instrument. If a policy on your shelf, or a compliance page on a supplier's website, cites the NDPR 2019, it is citing something the regulator has retired. That is a useful test to run on anyone selling you software.

Health data is sensitive data, and consent is not your basis

The Act's section 65 defines sensitive personal data to include health status. Everything a clinical record holds sits in the strictest category the Act has.

The part that surprises people is what follows. Section 30(1)(g) permits processing for the purposes of medical care or community welfare, undertaken by or under the responsibility of a professional or similar service provider owing a duty of confidentiality. Consent is not the required lawful basis for ordinary clinical records. A practice that builds its whole record-keeping around a consent form, or buys software that gates the chart behind one, has solved a problem it did not have, and has created a real one, because consent can be withdrawn and a clinical record cannot simply vanish when it is.

Consent still matters for the things outside care: research, marketing, sharing with a party who is not treating the patient. Keep it where it belongs.

Whether you have to register, and what it costs

The Commission's Guidance Notice on registration, referenced NDPC/HQ/GN/VOL.03/B/24 and dated 19 December 2024, is reproduced as Schedule 7 to the directive. The trigger is a filing system plus either more than 200 data subjects in six months or operation in a named sector. Health is a named sector.

For most practices, that means the question is not whether but which tier:

• Ordinary High Level, 10,000 naira. Named in the notice as covering primary health centres and independent medical laboratories, and processors handling sensitive personal data of more than 200 data subjects for commercial purposes. Also the tier for 200 to 1,000 data subjects in six months.
• Extra High Level, 100,000 naira. Named as covering hospitals providing tertiary or secondary medical services, and the tier for 1,000 to 5,000 data subjects in six months.
• Ultra High Level, 250,000 naira. Banks, telecoms, insurers and payment providers, and anyone over 5,000 data subjects in six months.

Section 44(1) of the Act requires registration within six months of becoming a controller of major importance. Ordinary High Level renews annually and is exempt from the Compliance Audit Returns the higher tiers file; a material change has to be notified within 60 days. The two upper tiers file their returns through a licensed Data Protection Compliance Organisation and cannot self-file, and late filing costs the fee plus half again.

For scale on the downside: section 48 sets the penalty for a controller of major importance at the greater of 10,000,000 naira or 2% of the preceding year's annual gross revenue, and the greater of 2,000,000 naira or 2% for everyone else.

An officer, and an assessment before you start

Section 32(1) requires a controller of major importance to designate a data protection officer. Section 32(2) allows that to be an employee or someone engaged under a service contract, so a small practice does not need a new full-time post.

What it does need is a real one. Article 12(5) of the directive has the officer reporting directly to management, Article 12(4) protects them from dismissal for doing the job, and Article 11(2) requires their contact details to be published and notified to the Commission. Article 14 has the Commission maintaining a database of certified officers and verifying that certification at registration and at audit. A name written into a policy nobody has met will not survive contact with any of that.

The assessment is the piece most often missed. Article 28(3) makes a data protection impact assessment mandatory, and filed with the Commission, where the processing involves sensitive data or health care services. Article 28(9) requires it before processing starts, and Article 28(4) requires it to be vetted by a Commission-accredited certified officer. Article 28(6) allows non-compliance to be met with a restriction on the platforms through which data subjects reach you.

Article 31 goes further and reads almost as a specification for software: an assessment before deployment, privacy by design and by default, a privacy policy inside the software, a statement before installation naming the data types and the lawful purpose, a support route from within the product, a way for a person to disable or uninstall it, and a list of the countries data is handled in with their supervisory authorities.

Seventy-two hours, and then immediately

Section 40(2) of the Act and Article 33(1) of the directive give you 72 hours from becoming aware of a breach to notify the Commission, where the breach carries a risk to people's rights and freedoms. Article 33(3) requires the affected people to be told immediately, and Article 33(2) treats exposure of sensitive data as a high-risk marker in itself, so for a health record the duty to tell the patient effectively always bites. Article 33(5) lists eight things the notification has to contain.

Seventy-two hours is not long enough to work out who decides, who signs and where the facts come from. Decide those now. The practical question to ask of any record system is whether, on the morning after something went wrong, it can tell you which records were reached and by whom, because that is the content the notification needs and the thing a paper register cannot give you at all.

What the National Health Act adds

The 2014 Act is health-specific and it is blunt. Section 25 requires a health establishment to keep a record for every patient. Section 26 makes all information about a user confidential. Section 29(1) puts a positive duty on the person in charge of the establishment to set up control measures to prevent unauthorised access to those records, and section 29(2) makes offences of falsifying a record, altering or destroying one without authority, copying one without authority, re-linking identifiers to de-identified records, accessing one without authority, and modifying the system used to store or retrieve them. The penalty is up to two years, a fine of 250,000 naira, or both.

Read section 29(2) beside the directive's Article 28 and a shape appears: the law expects a record that can be shown not to have been quietly changed. That is a property to look for in software, and to ask about directly.

A note on sourcing. Sections 25 to 29 above are read from the gazette itself, at pages A154 and A155 of Official Gazette No. 145 of 27 October 2014, linked below. The list of offences in section 29(2) and the penalty attached to them are taken from a secondary reading of the same Act rather than from that scan, which carries no text layer; if you are relying on the exact wording of an offence, read the gazette page.

The open question: how long to keep a record

Here the sources do not resolve, and pretending otherwise would be worse than saying so.

Article 49(3) of the directive says that where no timebound obligation is provided by law, storage shall lapse not later than six calendar months after the original purpose of the processing has been accomplished. Six months is flatly incompatible with a longitudinal clinical record, which is the point of a clinical record. Article 49(4) preserves storage for the defence of a legal claim or for due diligence, which is probably the hook a practice would rely on. It is not a stated clinical exemption, and it is not the same thing as one.

We could not establish a statutory retention period for Nigerian health records. There is a figure circulating online (six years for adults, and until the age of 21 plus six for minors), and we could not trace it to any Nigerian instrument. Do not build a retention policy on it. This is the one item in this piece that needs a lawyer rather than a reading, and it is worth the hour.

What to ask of the software

None of the above is satisfied by buying something. But some of it is made much harder by buying the wrong thing, so a few questions are worth putting directly to anyone selling you a record system:

• Can one practice's records be reached from another? The answer you want is no, structurally, not "we would not do that".
• Can a signed note be edited afterwards? The answer you want is that it cannot: a correction is a new note attached to the original, with a reason, and both stay readable.
• What happens to work the system rejected? The answer you want is that it is kept, not discarded.
• Who did what, and can you show it? Section 29 asks you to control access; a breach notification asks you to describe it afterwards.
• Which instrument does their own compliance page cite? If it is the NDPR 2019, ask when they last read the directive.

RizCare is built to help an establishment meet its section 29 duty, and that is the correct way to phrase it: there is no such thing as certification against section 29, and anyone offering you one is selling something that does not exist. Records belong to the practice that made them and cannot be reached from another. A signed note is never edited. A correction is a new note attached to the original, with a reason, and both stay readable. Nothing recorded is deleted, including work the practice sent back for review. Every action is recorded against the person who took it.

Registration, the officer, the assessment and the 72-hour plan are yours. They are cheaper now than they will be on the morning you need them.