WhatsApp Business NDPA 2023 Compliance Guide for Nigerian Small Businesses: No Wahala!

Dem Say NDPA Don Land: Your WhatsApp Business Must Follow Rule

Editor's note: I'm Ksenia, founder of BossBot. Nigeria's data protection law has been updated: the Nigeria Data Protection Act 2023 (NDPA) — signed June 2023 — supersedes the original NDPR 2019 and establishes the Nigeria Data Protection Commission (NDPC) as the enforcement authority. For WhatsApp business use, the key obligations remain the same: lawful basis documentation, explicit opt-in flows for marketing, and data minimisation. Where BossBot fits: 1-3 person Nigerian small business operations wanting done-for-them WhatsApp CRM. Where enterprise compliance platforms (OneTrust, etc.) win: 5+ team operations with dedicated data governance workflows. — Ksenia

My people, listen well! If you run a small business in Nigeria and you dey use WhatsApp Business to connect with your customers, then you must sabi about the Nigeria Data Protection Act 2023 (NDPA). This law — which updated and replaced the original NDPR 2019 — na serious matter o. The government dey say: 'Customer data na precious thing; no go just dey collect am anyhow.'

Small businesses using WhatsApp Business in Nigeria must comply with NDPA 2023 by ensuring transparent data collection, obtaining explicit user consent before marketing, and safeguarding customer information. The Nigeria Data Protection Commission (NDPC) — established by NDPA 2023 — is the enforcement body, and the fines for serious breaches fit 'chop your money' well well.

For many Nigerian small businesses, WhatsApp is the main line to customers — from Lagos traders on Balogun Market to Abuja service providers. The convenience of WhatsApp is real, but it comes with obligations. You can't just 'do anyhow' with people's information and expect no consequence.

Wetin You Fit Collect and Wetin You No Go Touch With Long Pole via WhatsApp

NDPA 2023 says you must only collect data that is adequate, relevant, and limited to what is necessary for your purpose. In plain Nigerian English: no go dey collect wetin no concern your business!

Data you can generally collect (with good reason and consent):
- Basic contact info: Name, phone number, email (if they provide it) — essential for responding to orders and inquiries
- Transactional data: Order details, payment status (paid via Flutterwave, pending on Paystack), delivery address — helps you fulfill orders
- Customer service history: Chat history, specific requests or complaints — helps you resolve issues
- Preference data: If a customer tells you they prefer certain products or services

Data you should be very careful with (or avoid entirely for WhatsApp Business):
- Sensitive personal data: Health information, religious beliefs, political opinions, biometric data — unless your business specifically deals with health (like a pharmacy or clinic), collecting this via WhatsApp for general business is a big NO. NDPA 2023 treats this category with extra strictness
- Excessive information: Don't ask for marital status if you're selling shoes. Don't ask for their mother's maiden name if you're just confirming a delivery. Data minimisation is key

Always ask yourself: 'Do I really need this information to serve this customer?' If the answer is no, leave it alone.

Consent Na Your Master Key: How To Get Am Right

For NDPA 2023, consent is king! You can't just add someone to your broadcast list or send them marketing messages 'because you have their number.' That one na 'follow come' wahala. Consent must be:

• Freely given: No force, no trickery
• Specific: Tell them exactly what they're consenting to — 'Can I send you promotional messages about our new products?' is specific; 'Can I use your data?' is not
• Informed: Use clear, simple language
• Unambiguous: A clear affirmative action — not silence or inactivity

How to get consent on WhatsApp Business:

Welcome message opt-in (when a new customer first messages you):
Customer: 'Hello, I saw your post online — do you deliver to Ikeja?'

You/bot: 'Welcome to [Business Name]! Yes, we deliver to Ikeja and most of Lagos. Reply YES to receive order updates and exclusive offers by WhatsApp, or NO to only receive replies to your enquiries.'

Website opt-in: If you have a website, include a WhatsApp consent checkbox during checkout or signup. Don't pre-tick it.

Direct ask: 'Would you like to join our VIP list for early deals? Reply YES if interested!'

Important: Always keep a record of when consent was given and what was agreed. And make opt-out simple — if someone says 'stop sending me messages,' comply sharp sharp. NDPA 2023 requires this.

Practical WhatsApp Flows for NDPA-Compliant Nigerian Businesses

Here's what compliant WhatsApp communication looks like in practice for common Nigerian small business types:

Fashion/retail business (Lagos market trader or online store):
Customer: 'I saw your dress on Instagram. How much and do you have my size?'

You: 'Hello! The ankara wrap dress is ₦18,500. We have sizes 8-18. To confirm your order, we need: (1) your delivery address, (2) size, (3) preferred payment — Paystack link or bank transfer. We'll collect only what we need for your order.'

After order: Send confirmation with Paystack receipt. If they opted in to marketing, you can send broadcast about new arrivals. If they didn't, only send order status updates.

Service business (plumber, electrician, event decorator):
Customer: 'I need someone to fix my AC in Lekki. How much?'

You: 'Hello! For AC repairs in Lekki, our callout + basic service starts from ₦12,000 depending on the fault. To book, we'll need your address and a convenient time. Your contact details are only used to arrange the job — reply YES if you'd also like to receive our maintenance tips and offers by WhatsApp.'

Handling a data deletion request:
Customer: 'I don't want my details with you anymore. Please delete everything.'

You: 'Understood — no problem. I'll remove your contact details, order history, and WhatsApp number from our records within 5 business days. You'll receive a final confirmation message once done. Thank you for letting us know.'

Under NDPA 2023, the right to erasure is real. Not having a process for this is a compliance gap.

Wetin Fit Happen If You No Follow NDPA 2023 Rules?

My friend, NDPA 2023 is not something to play with. The Nigeria Data Protection Commission (NDPC) has enforcement powers, and the penalties fit 'chop your money' well well — especially for businesses that handle health data, financial data, or large customer lists.

Fines under NDPA 2023:
- For standard violations: up to ₦10 million or 2% of annual gross revenue — whichever is higher
- For serious breaches involving large-scale data processing or data controllers of major importance: up to ₦2 billion or 2% of global annual turnover

For a small Lagos business turning over ₦50 million a year, a 2% fine alone would be ₦1 million — before reputational damage.

Reputational damage: If news gets out that your business mishandled customer data, customers will 'run away.' Bad news spreads fast on Nigerian Twitter (X) and WhatsApp groups. One data breach can cripple a small business reputation for years.

Legal action: Customers whose data has been misused can seek compensation, leading to court cases and legal fees on top of any NDPC fine.

Operational disruption: The NDPC can order you to stop processing data — which can effectively shut down operations for a business that relies on WhatsApp.

The most common risk for small businesses is not dramatic hacking — it's broadcasting marketing messages to people who never opted in, or keeping customer chat logs indefinitely without any data retention policy. These are easy to fix before there's a problem.

Your NDPA 2023 WhatsApp Compliance Checklist

Here's a practical checklist to make sure your WhatsApp Business setup is compliant — no need for a lawyer to start:

1. Privacy policy link: Add a link to your Privacy Policy in your WhatsApp Business profile description. The policy should say what data you collect, why, and how long you keep it
2. Explicit consent for marketing: Get clear affirmative consent before adding anyone to a broadcast list. Never add someone just because they messaged you once
3. Easy opt-out: Include an opt-out option (e.g., 'Reply STOP to unsubscribe') in your first broadcast message. Honour it immediately
4. Data minimisation: Only collect name, phone number, and information needed for the specific transaction. Not more
5. Secure storage: If you save customer chats or export data to a spreadsheet, make sure that file has access controls — don't leave it open in a shared Google Drive
6. Staff training: Anyone who handles customer WhatsApp conversations must understand that personal data must not be shared, sold, or used for purposes beyond what was disclosed
7. Data retention policy: Define how long you keep customer information. Old customer chats from 3 years ago that you no longer need? Delete them
8. Respond to requests: If a customer asks to see their data, correct it, or have it deleted — respond promptly. NDPA 2023 expects a response within a reasonable timeframe
9. Regular review: Periodically check that your practices still match your privacy policy. Businesses change; make sure the policy keeps up

NDPA 2023 is not designed to destroy small businesses — it's designed to build customer trust. Following these basics protects you and shows your customers that their data is in safe hands.