NDPA 2023 for health technology companies: what actually changes

The Nigeria Data Protection Act 2023 did not invent obligations that health technology companies previously lacked. It gave them an enforcement structure, and it moved health data from something a company treated carefully because it felt right to something a company treats carefully because it is accountable for it.

This is not legal advice. It is what I check first when I review a health technology company's data posture, and it is where I find problems.

Health data is a special category, and consent is not the default answer

The instinct is to solve everything with a consent checkbox. Consent is a poor lawful basis for clinical processing: it must be freely given, and a patient who cannot receive care without ticking the box is not giving it freely. Clinical processing usually rests on a different footing, and secondary processing — analytics, product improvement, research — needs its own basis, documented separately.

The exercise that surfaces this is unglamorous: list every processing activity, name the purpose, name the basis, name the retention period. Most companies discover on the second column that three activities have no articulated purpose beyond "we collected it".

Access control is where the audit finds you

In small teams, everyone has production access because that is how the product got built. In a health company, that means every engineer can read identifiable clinical records, and there is no record of who read what.

Role-based access with least privilege, and an append-only audit log of reads as well as writes, is the single highest-value control available. Reads matter more than writes here — the harm case in health data is disclosure, and a system that logs only mutations cannot answer the question that will be asked.

Cross-border transfer is a decision you already made

Your cloud region was chosen for latency or credits. Under the Act, it is also a transfer decision requiring an adequacy or safeguards analysis. That is fixable, but only if you know where the data is — including the analytics vendor, the customer support tool, the error-reporting service, and the spreadsheet somebody exported.

The practical list

• Maintain a processing register and a DPIA for anything high risk, updated when the product changes, not annually.
• Appoint someone accountable, with the standing to stop a launch.
• Write a retention schedule and implement deletion. Unbounded retention is the commonest finding I make.
• Paper your processors. A subprocessor without a data processing agreement is your exposure.
• Rehearse a breach response with a clock on it. Timelines are unforgiving and improvisation is expensive.
• Design subject rights into the product — access, correction, erasure — because handling them manually stops scaling almost immediately.

Why this is commercial, not defensive

Every serious institutional buyer, every state partnership and every investor doing diligence now asks these questions. Companies that can answer them in a morning win deals from companies that need six weeks and a consultant. Compliance work done early is cheap and reads as competence; done late it reads as risk.