The NDPA 2023, in plain English.
The Nigeria Data Protection Act 2023 (NDPA) sets the rules for handling personal data, including the pupil, parent and staff records every school keeps. Here is what it means for your school, and how EduLedga helps.
This page is a plain-English guide, not legal advice.
Your school is the controller. EduLedga is the processor.
The controller decides why and how personal data is used. The processor handles it on the controller's instructions. For your pupils', parents' and staff records, your school is the controller and EduLedga is the processor. That is written down in our Data Processing Agreement.
For our own business data, such as enquiries and demo sign-ups, EduLedga is the controller, as explained in our Privacy Policy. → /legal/privacy
Every use of data needs a good reason.
Section 25 of the NDPA lists the lawful bases for using personal data. The ones schools rely on most are:
- Contract: what you need to run the education parents have signed their child up for, such as records, results and fees.
- Legal obligation: what the law requires of your school, such as returns to education authorities.
- Consent: for optional uses, such as a child's photo on your website or marketing messages. Consent can be withdrawn at any time.
- Legitimate interests: for some everyday running of the school, as long as it doesn't override the person's rights.
Extra care for children.
Most people in a school's records are children. Under section 31 of the NDPA, where you rely on consent for a child's data, you need consent from a parent or legal guardian. The Act also allows processing for education by a professional under a duty of confidentiality. EduLedga does not market to children, and photo consent is separate and optional.
What parents, pupils and staff can ask for.
Under the NDPA, people can ask to see the data held about them, have it corrected, have it deleted, object to some uses, withdraw consent, and receive their data in a usable format. Requests about school records go to your school, as controller. EduLedga helps you find, export and correct the records, and we pass on any request we receive to your school.
Keeping data safe, and speaking up if something goes wrong.
The NDPA requires controllers and processors to protect personal data. EduLedga uses HTTPS on every connection, stores passwords as one-way hashes, gives each person their own login and role, and logs every change with who made it and when. If a breach affects your school's data, we tell your school without undue delay and help you meet your own duties.
Why it matters.
The Nigeria Data Protection Commission (NDPC) enforces the Act. Under section 48, penalties can reach the greater of ₦10 million or 2% of annual gross revenue for controllers and processors of major importance, and the greater of ₦2 million or 2% for others.
Where your data goes.
Some of the providers that help us run EduLedga are outside Nigeria. Each is listed, with what it does and where it is, and our Privacy Policy explains the safeguards for data stored or handled outside Nigeria. EduLedga does not use pupil data to train AI models.
Questions about your data?
Our Data Protection Officer is Ajay Chukuniku Daniel. Email privacy@eduledga.com or call 0814 373 1505.
Frequently asked questions
Is EduLedga NDPA compliant?
EduLedga is designed to help your school meet its duties under the NDPA. Your school is the controller and EduLedga its processor, under a written Data Processing Agreement. Your school stays responsible for its own decisions about pupil data.
A parent wants their child's data deleted. What do we do?
Check whether you still need the records, for example for results or legal duties. If not, delete them in EduLedga, or ask us to help.
Read moreDo we need parents' consent for everything?
No. Consent is one lawful basis among several. Many school records rely on contract or legal obligation. Optional uses, such as photos and marketing, need consent.