Every landlord is now a data handler. The moment you collect a prospective tenant's name, ID, payslips, bank statements or guarantor details, you are processing personal data — and since 2023, that activity is governed by law. The Nigeria Data Protection Act (NDPA) 2023 applies to property owners and managers just as it does to banks and tech companies. Here is what it means in practice, without the legalese.

What the NDPA is, and why it applies to you

Signed into law in June 2023, the NDPA is Nigeria's primary data-protection statute. It is enforced by the Nigeria Data Protection Commission (NDPC) and supersedes the older 2019 regulation. If you decide what tenant data to collect and why, the Act treats you as a data controller — with real obligations, and real penalties for ignoring them.

Your lawful basis for holding tenant data

You cannot process personal data simply because you want to; you need a lawful basis. The Act provides several, and for landlords the most relevant are usually performance of a contract (the tenancy itself) and legitimate interest — not consent alone. That distinction matters, because where you do rely on consent, the bar is high: it must be freely given, specific, informed and unambiguous. Pre-ticked boxes and "implied" consent do not count, and the burden of proving consent falls on you.

Your core duties, in six points

Minimise. Collect only what the tenancy genuinely requires. If you do not need it, do not ask for it.
Be transparent. Tell applicants what you are collecting and why.
Secure it. Put real safeguards around stored ID, income and guarantor data — access controls, not a shared chat folder.
Retain only as long as necessary. The Act sets no fixed period, but "indefinitely" is not it — rejected applicants' files should not live on your laptop forever.
Honour tenant rights. Tenants can ask to access, correct or delete their data, withdraw consent, and object to certain processing.
Report breaches. If data is compromised in a way that risks people's rights, you must notify the NDPC within 72 hours, and affected tenants where the risk is high.

Do you need to register with the NDPC?

Larger operators face an extra step. The Act singles out a "data controller of major importance," and NDPC guidance sets the threshold at processing the data of more than 200 people within a six-month period — a line a busy agency or property manager can cross without realising. Those who qualify must register with the NDPC and designate a Data Protection Officer. If you manage tenants at any scale, check whether this applies to you.

What non-compliance costs

The penalties are not symbolic. For a data controller of major importance, a serious breach can attract the greater of ₦10 million or 2% of annual gross revenue; for smaller controllers, the greater of ₦2 million or 2% of revenue. The NDPC can also order you to compensate affected individuals and to stop the offending processing.

A simple compliance checklist

Record a lawful basis for each category of tenant data you hold.
Trim your application forms to what you actually use.
Store documents somewhere access-controlled, not in personal chat threads.
Set a retention limit and delete rejected applicants' files.
Have a simple way to handle a tenant's access, correction or deletion request.
Know who you would call — and that the clock is 72 hours — if data ever leaks.

A compliance-first property platform handles much of this operationally: capturing a recorded lawful basis per tenant, keeping ID and financial documents access-controlled, enforcing retention limits, and maintaining the audit trail the NDPA's breach rule assumes. It is exactly the kind of housekeeping the Act rewards.

This article is general information, not legal advice, and data-protection duties vary with the size and nature of your operation. For anything consequential, confirm the current requirements with the NDPC or a Nigerian data-protection lawyer.