NDPA Compliance for HMOs and Health-Tech Startups Receiving Patient Data in Nigeria (2027 Guide)

Hospitals send you patient data: claims, member lists, appointments. You lead compliance at an HMO, a health maintenance organisation that pays hospitals for its members' care, or you run a health-tech startup. Under Nigerian law, data about a person's health is sensitive, and the law sets duties for whoever handles it. This guide explains the Nigeria Data Protection Act 2023 and the regulator's 2025 Directive in plain words. It is general information, not legal advice, so take each point to a Nigerian data-protection lawyer.

Quick Answer

If you receive patient data from Nigerian hospitals, the Nigeria Data Protection Act 2023 (NDPA) sets duties for you, and a lawyer should confirm each one.

• Know your role and your lawful basis, the legal ground for using the data. Take advice on consent for health data, where two official texts leave a question open.
• Keep the data secure, assess the risk before you start, and check agreements with anyone who handles it for you.
• Be ready to report a breach that risks people's rights to the Nigeria Data Protection Commission (NDPC) within 72 hours. Tell the people affected at once when the risk is high.
• Ask your adviser whether your organization is of major importance. That decides registration, and it may bring a data protection officer and a yearly audit return.
• Record the basis for every transfer out of Nigeria, and treat ClinikEHR's addendum as a contract, not as your notice to the NDPC.

What Is the Nigeria Data Protection Act, in Plain Words

The Nigeria Data Protection Act 2023 is the law on how organizations collect, use, share and keep information about people. It is Act No. 37, signed on 12 June 2023 (NDPC, 2023). The NDPC enforces it. In March 2025 the NDPC issued a General Application and Implementation Directive, called the Directive here (NDPC, 2025). The Directive also says the NDPC will stop applying the older 2019 Nigeria Data Protection Regulation.

Four terms come up again and again. A controller decides why and how personal data is used. A processor handles it for a controller. Sensitive personal data includes data about a person's health status. The person the data is about is called the person here.

This guide reflects the sources as read on 14 October 2026. Check the linked texts before you act.

Which Law Applies, and in What Role

Step 1: Confirm the Act Reaches Your Organization

The Act applies in three cases. Your organization is based, resident or operating in Nigeria. The processing happens in Nigeria. Or you are outside Nigeria but process the personal data of a person in Nigeria (NDPC, 2023, section 2). So a startup abroad that handles data about people in Nigeria is within what the Act says. The Directive adds that operating in Nigeria includes targeting a person in Nigeria (NDPC, 2025, Article 8).

An organization must still comply with the Act when its sector regulator has issued data protection rules of its own, the NDPC's FAQs say (NDPC FAQs). Write down where you are based, where you process data and whose data you hold.

Step 2: Name Your Role for Each Set of Data

The Act defines a controller as a body that, alone or with others, decides the purposes and means of processing personal data. A processor processes personal data on behalf of, or at the direction of, a controller or another processor (NDPC, 2023, section 65).

The role matters most when something goes wrong. A processor tells its controller, and the controller tells the NDPC (Step 8). Work out your role for each set of data, with your adviser, before the first file arrives.

Lawful Basis, Consent and Health Data

Step 3: Record a Lawful Basis for Each Use

The Act lists six lawful bases for processing personal data (NDPC, 2023, section 25). They are consent, a contract with the person, a legal obligation, the vital interest of the person or someone else, a public-interest task or official authority, and legitimate interests. Legitimate interests fail where they override the person's rights, freedoms and interests, or where the person would not reasonably expect the processing. The Directive lists the same six (NDPC, 2025, Article 16).

If you rely on consent, the burden of proof is yours. Silence is not consent. Consent must be affirmative, not a pre-selected box, and the person must be told beforehand that they can withdraw it (section 26). The Directive adds that you must keep a record of consent (Article 17).

Step 4: Handle Health Data as Sensitive Personal Data

The Act defines sensitive personal data to include data about a person's health status (NDPC, 2023, section 65). It bars processing it unless a listed condition applies (section 30). Three conditions matter here. Condition (a) is consent for the specific purpose. Condition (b) is necessity for obligations or rights under employment or social security laws. The Act's definition of social security laws names the National Health Insurance Authority Act among others. It does not say an HMO's processing falls under this condition, and this guide does not either. Condition (g) covers processing for:

medical care or community welfare, and undertaken by or under the responsibility of a professional or similar service provider owing a duty of confidentiality

Nigeria Data Protection Act 2023, section 30(1)(g)

The Directive has a rule of its own. It applies without prejudice to the Act, and it states:

consent is required: a) For any direct marketing activity; b) For the processing of sensitive personal data;

NDPC, 2025, General Application and Implementation Directive, Article 18(1)

The two texts do not obviously line up, and the Directive says the Act prevails in a conflict (NDPC, 2025, Article 3). The sources do not say how they fit together for an HMO or a startup. This is a point to take legal advice on, so this guide does not choose.

Step 5: Tell People What You Do, and Honor Their Rights

When you collect personal data from a person, the Act asks you to tell them who you are, your lawful basis and who receives the data. You also tell them how long you keep it, their rights, and their right to complain to the NDPC. This goes in a clear privacy policy (NDPC, 2023, section 27). The Act has a separate rule for data you did not collect from the person yourself (section 27(2)). Ask your adviser whether it applies to records you receive from a hospital.

People can ask what you hold and who received it, get a copy, and have data erased. They can withdraw consent and refuse a decision based only on automated processing with significant effects (sections 34, 35 and 37). Publish a privacy notice and name one person who answers requests.

Keeping the Data Safe

Step 6: Set Security Measures and Train Staff

The Act asks controllers and processors to use appropriate technical and organisational measures to protect personal data. Its examples include pseudonymisation, which means processing data so it can no longer be tied to one person without extra information kept apart, and encryption. They are examples, not compulsory measures (NDPC, 2023, section 39).

The Directive asks for schedules for monitoring, evaluating and maintaining data security systems. They cover training, software updates, database vulnerability tests, authentication checks and encryption reviews, among other things (NDPC, 2025, Article 29). It also expects staff training within six months of starting business, then at least yearly (Article 7). Write the schedule, limit access to people who need the data, and record who accessed what.

Step 7: Assess the Risk Before You Start, and Check Your Processors

Where processing may be likely to result in high risk to people's rights and freedoms, a controller must first carry out a data privacy impact assessment (DPIA). A DPIA is a process that identifies the risks of the planned processing and the measures to address them. If it still shows high risk, the controller must consult the NDPC (NDPC, 2023, section 28).

The Directive lists sensitive data and health care services among the cases where a DPIA is mandatory and filed with the NDPC. It says a data protection officer accredited by the NDPC must vet it (NDPC, 2025, Article 28).

A controller that uses a processor must make sure the processor follows the Act, under a written agreement. A processor must tell the controller when it engages another processor (section 29). Complete the DPIA before live data arrives, and check that every outside provider has a written agreement with you.

When a Breach Happens

Step 8: Prepare the Notices Before You Need Them

A personal data breach is a security failure that leads, or is likely to lead, to loss, destruction or alteration of personal data. It also covers unauthorised disclosure of, or access to, that data (NDPC, 2023, section 65). The Act says who tells whom (section 40).

The 72-hour duty reads:

within 72 hours of becoming aware of a breach which is likely to result in a risk to the rights and freedoms of individuals

Nigeria Data Protection Act 2023, section 40(2)

Note the trigger. The notice to the NDPC follows a risk to people's rights and freedoms. High risk is the trigger for telling the people themselves. Do not read the 72 hours as applying only to high-risk breaches.

The Directive repeats the 72 hours and lists what the notice should contain (NDPC, 2025, Article 33). That includes what happened and when, the information involved, the risk of harm, the number of people at real risk, the steps taken, and a contact for the NDPC's questions.

Here is an illustrative timeline with invented times. A startup that is itself the controller becomes aware of unauthorised access to a file of member records at 09:00 on a Monday. Its 72 hours end at 09:00 on Thursday.

Registration, Yearly Returns and Major Importance

Step 9: Ask Whether Your Organization Is of Major Importance

The Act requires controllers and processors of major importance to register with the NDPC, and to report significant changes within 60 days. The NDPC publishes the register and may exempt a class from registering (NDPC, 2023, section 44). The Act leaves the definition to the NDPC (section 65).

The Directive sets three levels of major data processing: ultra-high, extra-high and ordinary-high (NDPC, 2025, Article 8). Its Schedule 7 is a Guidance Notice on registration. It treats an organization as of major importance if it keeps or has access to a filing system and meets one of three tests. It processes the data of more than 200 people in six months. It runs commercial technology services on another person's device that can store personal data. Or it processes personal data as an organisation or service provider in a listed sector, and Health and Insurance are listed sectors.

The Notice names insurance companies at the ultra-high level. It does not name HMOs. So whether an HMO or a startup is of major importance, and at which level, is for the organization and its adviser. This guide places no organization in a level and gives no fee amounts.

A controller of major importance must also name a data protection officer (DPO). This is a person with expert knowledge of data protection law, either an employee or engaged by contract (section 32). Put the question of major importance to your adviser in writing.

Step 10: Plan the Yearly Audit Return

A compliance audit return (CAR) is the yearly filing a registered organization makes with the NDPC. The Directive says an organization of major importance files one every year. The deadline is 31 March each year for an organization established before 12 June 2023. A newer organization files its first return within 15 months of establishment (NDPC, 2025, Article 10).

Unless the NDPC approves otherwise, the top two levels file through a Data Protection Compliance Organisation (DPCO) licensed by the NDPC (Article 10). The ordinary-high level renews its registration each year instead (Article 9). The NDPC's FAQs repeat the deadline and the DPCO route (NDPC FAQs).

Registration and filing do not prove compliance. The Directive says they show accountability and good faith but do not replace concrete evidence if someone complains (Article 48).

Moving Data Out of Nigeria

Step 11: Record the Basis for Every Transfer

The Act bars moving personal data out of Nigeria unless one of two things is true. Either the recipient is covered by a law, binding corporate rules, contract clauses, a code of conduct or a certification that gives adequate protection. Or a condition in section 43 applies (NDPC, 2023, section 41). You must record the basis for each transfer.

The Directive gives three grounds. One is an adequacy decision by the NDPC, a finding that a country protects data well enough. Another is a transfer instrument the NDPC approved. The third is another lawful basis. It also requires consent before a transfer to a country the NDPC has not found adequate (NDPC, 2025, Article 18 and Schedule 5, paragraph 1). The Act's section 43 lists consent as one of several conditions, so ask your adviser how the Directive's consent rule fits. The sources read here list no country as adequate, so this guide names none. List every country your data goes to, including where outside providers keep it, and record the basis for each.

What Happens if You Get It Wrong

A person who is aggrieved may complain to the NDPC. The NDPC may investigate, order compliance and, after an investigation, make an enforcement order. That can include a cease and desist order that stops processing (NDPC, 2023, sections 46 and 47). An enforcement order may carry a penalty or remedial fee. For a controller or processor of major importance, the maximum is the greater of ₦10,000,000 and 2 percent of annual gross revenue in the preceding financial year. For others it is the greater of ₦2,000,000 and 2 percent (section 48).

Failing to comply with a compliance order is an offence. The penalty is a fine up to those amounts, or up to one year in prison, or both (section 49). A person harmed by a violation may sue for damages (section 51).

Where the ClinikEHR Data-Protection Addendum Fits

ClinikEHR is a product of Bettar Platforms, Inc. The data-protection addendum, version 2026-10-09, is a contract between Bettar Platforms, Inc. and an organization that receives patient information through the ClinikEHR API (api.clinikehr.com). An API is a set of routes that software calls to read or send data. ClinikAPI (clinikapi.com) is a separate product built around the FHIR health data standard, with its own site, keys and licence. In the clause summaries below, ClinikEHR means Bettar Platforms, Inc., the party the addendum calls we.

The addendum is a contract. It is not a registration, a filing or a certificate, and it does not make anyone meet the Act. Under it, registering with and notifying the NDPC stay with the organization. ClinikEHR is not connected to the NHIA or to any national system.

Approval and the Disclosure Record

Receiving patient information through the API takes two yeses. A ClinikEHR reviewer first decides whether to approve your organization for the kind of information you ask for. For an insurer, that means enrollees (the members it covers), claims (hospital bills to it) and authorization requests (asks to agree in advance to pay). The application asks for your purpose, legal basis, jurisdiction, regulator and safeguards, plus named contacts for security and for breach notice. Then the hospital's owner decides what to grant and records the basis on which it may share. That basis is a product setting, not a lawful basis under the Act.

An HMO's API connection needs two Enterprise requirements, always as a pair. Its developer workspace is on the Enterprise contract plan, which ClinikEHR sets on request. The hospital is on the Enterprise plan with API access switched on. Connecting Your HMO to the ClinikEHR API gives the full path.

ClinikEHR records every disclosure made to you: which patient, which kind of record, when, and under which connection and basis. The hospital can see that record, and ClinikEHR keeps it for seven years. This record is not the breach record the Act asks you to keep, and this guide does not say it meets any retention rule.

Roles, the Nigeria Clause and Other Terms

Under clauses 1.3 and 1.4, the organization receives the information as an independent controller, for the purpose the hospital agreed to, and ClinikEHR is not its processor. That is the addendum's position, so your adviser should still confirm your role under the Act.

The Nigeria clause, in clauses 8.4 to 8.6, contains terms based on the Nigeria Data Protection Act. It treats an organization established in Nigeria, or processing the information of people in Nigeria, as a controller for what it receives. It covers lawful basis, sensitive personal data, people's rights, security, breach notification and transfers. Where the Act requires the organization to register with or notify the NDPC, it will do so. It will also tell ClinikEHR if the NDPC asks about information received through the API. Where the Act and the addendum both apply, the organization follows whichever protects the person more.

When a hospital withdraws a permission, the API stops returning that information on the next request. You then return or destroy what you hold for that hospital's patients, unless the law requires you to keep it.

Several Breach Clocks, None of Them Your Notice

ClinikEHR's documents contain more than one breach clock. Each covers a different relationship.

The last row is ClinikEHR's promise about its own handling of information it holds, not a notice given for anyone else.

None of these clocks discharges your own notice to the NDPC. If you are the controller, your 72 hours run from when you become aware. Decide with your adviser who sends that notice, and when.

Changes That Are Pending

The Act may change. The National Assembly Library Trust Fund reported on 14 May 2026 that a legislative review of the Act has begun (National Assembly Library Trust Fund, 2026). Digital Policy Alert reports that HB 2436, a House of Representatives bill to amend it, was introduced on 23 July 2025 (Digital Policy Alert, 2025). Both are pending, and this guide describes the Act as it stood when the sources were read. It says nothing about what any bill would change.

How You Know It Worked

Each line is something you can show to your adviser.

• Your role and lawful basis are written down for each data set.
• Where you rely on consent, a record shows who agreed, when, and for what.
• A privacy notice is published, and one named person answers requests.
• A security schedule exists, with training records.
• A DPIA is on file, and your adviser has said whether to file it with the NDPC.
• A breach notice template follows the Directive's content points, a named person decides when to send it, and a breach record exists.
• Your adviser's written view says whether you are of major importance, and any return date is in the calendar.
• Every transfer out of Nigeria has a recorded basis.
• For each ClinikEHR clock, you can say who tells whom, and which notice is yours.

Mistakes That Put HMOs and Startups at Risk

1. Counting 72 hours from the end of the investigation. The Act counts from becoming aware, and asks the controller to describe the nature of the breach where feasible (section 40(2)).
2. Following a guide older than the 2025 Directive. It may still rely on the 2019 Regulation, which the NDPC has said it will stop applying.
3. Using the Directive's section number for the person notice. In the Act, the duty to tell the person is section 40(3), and section 40(2) is the notice to the NDPC. The Directive's Article 33(3) deals with telling people but refers to section 40(2), so cite the Act's numbers.
4. Treating the hospital's recorded basis as your own. Your own use of the data needs its own lawful basis.
5. Asking for every permission on offer. The addendum asks for the least information that serves your purpose.

Frequently Asked Questions

What does the NDPA require of an organization that receives patient data from hospitals?

It requires a lawful basis for each use, extra care with health data, appropriate security and written agreements with processors. Where processing may be high risk, it requires a risk assessment first. Where a breach risks people's rights, the controller must tell the NDPC within 72 hours. Any transfer out of Nigeria needs a recorded basis. Organizations of major importance must also register, and a controller of major importance must name a data protection officer. The Directive adds yearly filing duties, which differ by level. This is general information, not legal advice.

Does the NDPA apply to a startup based outside Nigeria?

The Act says it applies where an organization outside Nigeria processes the personal data of a person in Nigeria. The Directive adds that operating in Nigeria includes targeting a person in Nigeria. Whether it applies to your startup is a question for your adviser.

Do we always need consent to process health data?

The texts do not settle this. The Act lists consent, obligations under social security laws and medical care under a duty of confidentiality among the conditions for sensitive personal data. The Directive says consent is required for processing sensitive personal data, and says the Act prevails in a conflict. How they fit for an HMO or a startup is a point to take legal advice on.

How fast must we report a breach to the NDPC?

A controller must notify the NDPC within 72 hours of becoming aware of a breach likely to result in a risk to the rights and freedoms of individuals. It must tell the people affected immediately where the risk is high. A processor must tell its controller on becoming aware, and the Act sets no number of hours for that step.

Do we have to register with the NDPC?

The Act requires controllers and processors of major importance to register. The NDPC decides who that is. Its Guidance Notice lists Health and Insurance among sectors and names insurance companies at the ultra-high level. It does not name HMOs. Whether your organization is of major importance, and at which level, is for you and your adviser.

Does the ClinikEHR data-protection addendum mean we meet the NDPA?

No. The addendum is a contract between Bettar Platforms, Inc. and an organization that receives patient information through the ClinikEHR API. Its Nigeria clause, for organizations established in Nigeria, contains terms based on the Nigeria Data Protection Act. It is not a certificate or a registration, and it does not confirm that anyone meets the Act. Read the Act and ask your own lawyer.

Does telling ClinikEHR or the hospital about a breach count as telling the NDPC?

No. The addendum asks an organization to tell ClinikEHR and the hospital within 72 hours of unauthorised access, and ClinikEHR has other breach clocks of its own. None of them discharges the controller's own notice to the NDPC under section 40(2) of the Act. Decide with your adviser who sends that notice.

What are the penalties under the NDPA?

An enforcement order may carry a penalty or remedial fee. For a controller or processor of major importance the maximum is the greater of ₦10,000,000 and 2 percent of annual gross revenue in the preceding financial year. For others it is the greater of ₦2,000,000 and 2 percent. Failing to comply with a compliance order is an offence, and a person who is harmed may sue for damages.

Conclusion

Two points stay open: consent for health data, and whether your organization is of major importance. Put both to your adviser early.

ClinikEHR's addendum covers its own part of the relationship and nothing more. If you want to connect through the developer portal, read the addendum first and contact ClinikEHR. The API documentation page introduces the API.

Related Articles

• Connecting Your HMO to the ClinikEHR API in Nigeria: Access, Approval and Data Protection Explained (2027)
• How to Build an HMO Claims Integration in Nigeria With the ClinikEHR API (Step-by-Step, 2027)
• Getting Paid by HMOs in Nigeria: The Complete 2027 Guide for Hospital Owners and Billers
• Pre-Authorization API for Nigerian HMOs: Approve or Deny PA Requests With a PA Code (2027)
• NHIA and Private HMOs in 2027: What Digital Claims Mean for Hospital and HMO Relationships in Nigeria
• Data-protection addendum for organizations
• ClinikEHR API documentation
• ClinikEHR pricing

Facts are as of the dates shown. Check the linked sources for updates. This is general information, not legal or professional advice.