NDPR Compliance

SocialLens Analytics Limited is committed to the highest standards of data protection and privacy. This document outlines our compliance with the Nigeria Data Protection Regulation (NDPR), 2019 issued by the National Information Technology Development Agency (NITDA).

Our Compliance Framework

SocialLens has implemented a comprehensive data protection framework aligned with NDPR requirements, including:

• Appointment of a qualified Data Protection Officer (DPO)
• Registration with NITDA as a Data Processor
• Implementation of privacy-by-design principles
• Regular data protection audits and impact assessments
• Staff training on data protection obligations
• Data breach response procedures

NDPR Data Protection Principles

We adhere to the eight core principles of the NDPR:

Your Rights Under NDPR

As a data subject in Nigeria, you have the following enforceable rights:

To exercise any of these rights, contact our DPO at dpo@sociallens.ng. We will respond within 30 days as required by NDPR.

Data Protection Officer (DPO)

Data Processing Register

As required by Article 4.1(3) of the NDPR, we maintain a Data Processing Register documenting:

• Categories of processing activities
• Data subjects and data categories
• Recipients and transfers (including international)
• Retention schedules
• Security measures implemented

This register is available for inspection by NITDA upon request.

Security Measures

We implement industry-standard security measures including:

• Encryption: AES-256 for data at rest, TLS 1.3 for data in transit
• Access Control: Role-based access, least privilege principle, MFA required
• Monitoring: 24/7 intrusion detection and log monitoring
• Backup: Regular encrypted backups with geographic redundancy
• Incident Response: Documented breach response procedure with NITDA notification within 72 hours
• Staff Training: Mandatory annual data protection training for all employees

Data Breach Notification

In the event of a personal data breach, we will:

1. Contain and assess the breach immediately
2. Notify NITDA within 72 hours of discovery
3. Notify affected data subjects where there is a risk to their rights
4. Document the breach and remediation actions

Third-Party Data Processors

We engage only processors who provide sufficient guarantees to implement appropriate technical and organizational measures. All processors sign Data Processing Agreements (DPAs) with standard contractual clauses. Current processors include:

• Google LLC — Analytics (Data Processing Addendum in place)
• Amazon Web Services (AWS) — Infrastructure (Africa region where available)
• Formspree — Form processing (DPA executed)

International Data Transfers

When personal data is transferred outside Nigeria, we ensure appropriate safeguards under Article 2.11 of NDPR:

• Standard Contractual Clauses (SCCs) as approved by NITDA
• Adequacy decisions where applicable
• Binding Corporate Rules (BCRs) for intra-group transfers

Data Protection Impact Assessments (DPIA)

We conduct DPIAs for high-risk processing activities, including our social media monitoring algorithms and sentiment analysis. DPIAs assess:

• Necessity and proportionality of processing
• Risks to data subjects
• Mitigation measures

Training and Awareness

All SocialLens employees receive:

• NDPR training upon hire
• Annual refresher training
• Role-specific privacy training for data handlers
• Breach response procedure training

Compliance Audits

We conduct internal data protection audits annually, covering:

• Processing register accuracy
• Security measure effectiveness
• Third-party processor compliance
• Data subject request fulfillment

External audits may be conducted by NITDA or qualified third parties as required.

Complaints Process

If you believe your data protection rights have been violated, please:

1. Contact our DPO directly at dpo@sociallens.ng
2. We will acknowledge within 5 business days and investigate
3. A resolution will be provided within 30 days
4. If unsatisfied, you may escalate to NITDA

Data Protection Fees

SocialLens has registered with NITDA and pays the applicable data protection fees as required under the NDPR Implementation Framework. Our NITDA registration number can be verified upon request.

Review and Updates

This NDPR Compliance Statement is reviewed annually and updated as necessary. The current version was approved by our Board of Directors on May 29, 2026.