Storage Is the
Compliance Surface

Nigeria’s Data Protection Act 2023 provides the national legal framework for protecting personal data and regulating how it is processed. The Act was signed on June 12, 2023, and established the Nigeria Data Protection Commission as the national authority. It applies to more than databases: collecting, using, sharing, transmitting, retaining, and deleting personal information can all matter.

One legal correction that matters for builders: NDPA covers processing broadly, not storage alone. Collection, use, disclosure, transmission, and other handling can still trigger obligations even when data is not durably retained. Storage is therefore my primary engineering risk surface, not the Act’s only concern.

My engineering response is deliberately conservative: minimize what is collected, establish a valid reason before processing it, make consent explicit where consent is the chosen basis, and avoid creating permanent records without a clear operational need.

Compliance language becomes more useful when translated into product decisions. My default sequence is:

1. Minimize: Ask only for information required to complete the immediate task.
2. Calculate locally: Perform scoring, estimation, or transformation in the browser when practical.
3. Request permission: Do not silently transmit personal information to analytics systems, vendors, automation tools, or outreach pipelines.
4. Retain deliberately: Store information only when there is a defined purpose, owner, access boundary, and deletion rule.
5. Escalate consequential actions: Require human review before external outreach, regulated reporting, or other high-impact use.

Storage is not the only compliance concern, but it is often where temporary processing becomes long-term exposure.

Once personal data is retained, the system inherits additional operational questions:

• Who can access it?
• Why is it still being kept?
• How is that access audited?
• Which systems or vendors receive copies?
• How can inaccurate information be corrected?
• When and how will the information be deleted?
• What happens if credentials or infrastructure are compromised?

That is why I treat durable retention as the primary engineering risk surface. Preventing unnecessary storage reduces the number of systems, permissions, integrations, and failure modes that must later be controlled.

Consider a business calculator or operational scorecard. A privacy-first version can accept values, calculate a result inside the browser, and discard the inputs when the session ends.

The tool does not need a customer profile merely to produce a score. It does not need to attach personal information to analytics events. It does not need to send every field to a backend before showing the result.

CALCULATE=BROWSER_LOCAL
PERSIST=EXPLICIT_USER_CHOICE
ANALYTICS_PII=NO
OUTREACH=HUMAN_REVIEW_REQUIRED

Persistent storage becomes a separate, visible decision. When a user chooses to save a result, request assistance, or enter an outreach workflow, the interface can explain:

• which information will be stored;
• why it is needed;
• what action will occur next;
• who is responsible for the information; and
• how the user can withdraw or change that decision.

This creates a clean boundary between calculation and collection. See also the Lead Leak Calculator and the privacy-first shipping receipt.

A product should not claim to be local-first while quietly sending form contents to analytics platforms, session-replay tools, logging services, AI providers, or unrelated automation systems.

Privacy has to survive the entire request path—not only the visible interface. That means reviewing network calls, logs, error reports, analytics payloads, third-party scripts, and automation hooks as part of the product’s data boundary.

In regulated environments, the software vendor should not unilaterally decide that a workflow is legally or operationally ready.

The responsible data controller—and any required licensed, regulatory, security, or compliance authority—must own final approval before information leaves the agreed safe zone or a consequential workflow goes live.

The vendor’s role is to make that decision inspectable: document the boundary, expose the data flow, enforce the approved controls, and preserve evidence that the system behaved as authorized.

Under the NDPA, I treat durable storage as the main engineering risk surface. Products should calculate first, collect minimally, store only under a clear lawful basis and transparent user experience, and leave final approval with the responsible data controller—not the vendor.

Privacy-aware design does not require removing automation. It requires placing automation inside explicit boundaries: local computation where practical, intentional collection, controlled retention, inspectable integrations, and human authority over consequential actions.

That is the standard I use when building calculators, scorecards, lead systems, and operational automation for regulated or privacy-sensitive work.

Discuss a privacy-first build →