Three acronyms come up whenever a product handles personal data across Nigeria, Europe and the US. They overlap, but they are not the same thing, and treating them as one leads to gaps or wasted effort.
In short
- NDPR and the Nigeria Data Protection Act 2023: law governing the processing of personal data of people in Nigeria, overseen by the Nigeria Data Protection Commission.
- GDPR: law governing the processing of personal data of people in the EU, with a near-identical UK GDPR after Brexit.
- SOC 2: not a law, but an independent audit report on security controls that US customers often require from suppliers.
Who each applies to
The Nigerian rules apply if you process personal data of people in Nigeria, or if you are established in Nigeria, regardless of where the data is stored. GDPR applies if you are established in the EU or UK, or if you offer goods or services to, or monitor, people there. SOC 2 applies only when a customer asks for it, but in US enterprise sales that is almost always.
A Lagos-based fintech serving Nigerian customers with a UK office and US investors could be subject to all three in practice.
What the laws require
- A lawful basis for each type of processing, such as consent, contract or legitimate interest.
- Clear privacy notices explaining what you collect and why.
- Data minimisation: collect only what you need, and keep it only as long as necessary.
- Respect for individual rights, including access, correction and deletion.
- Security measures appropriate to the risk.
- Breach notification to the regulator within 72 hours in most cases.
- Rules on transferring data across borders.
- For larger processors, registration, audits or a data protection officer.
What SOC 2 checks
SOC 2 assesses whether your controls meet the Trust Services Criteria, primarily security, and optionally availability, confidentiality, processing integrity and privacy. A Type I report checks that controls are designed correctly at a point in time. A Type II report checks that they operated effectively over a period, usually six to twelve months. Enterprise buyers generally want Type II.
Where they overlap
Access control, encryption, logging, incident response, vendor management and staff training appear in all three in some form. Build these controls once, document them well, and map the evidence to each framework. A single control, such as quarterly access reviews, can satisfy a GDPR security requirement, an NDPA obligation and several SOC 2 criteria at the same time.
Compliance is cheapest when it’s designed in, and most expensive when it’s retrofitted before a deal.
Cross-border transfers
Moving data between Nigeria, the EU and the US is where obligations diverge most. Both the NDPA and GDPR restrict transfers to countries without adequate protection, and require safeguards such as standard contractual clauses. Map where your data flows, including to cloud providers and support tools, and confirm the legal basis for each transfer.
A practical order of work
- Map the personal data you hold, where it lives and who can access it.
- Close the legal basics: privacy notices, lawful bases, processing records and data-processing agreements.
- Put core security controls in place and start collecting evidence that they operate.
- Pursue SOC 2 when US sales require it, using the evidence already gathered.
A note
This is a general overview, not legal advice. Requirements change and depend on your specific activities. Confirm your obligations with qualified counsel for each of your markets.